Cpe:2.3:a:trap:traq:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3atraptraq/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 20:04:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgtraQ: Stored cross-site scripting via file upload (CVE-2026-63197)https://feed.craftedsignal.io/briefs/2026-11-traq-xss/Tue, 03 Nov 2026 20:04:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-traq-xss/The traQ messenger application prior to version 3.28.3 is vulnerable to stored cross-site scripting (XSS) when configured with TRAQ_STORAGE_TYPE=local, allowing attackers to upload crafted SVG or HTML files for unauthorized JavaScript execution in a victim's browser.traQ messenger application versions prior to 3.28.3 contain a vulnerability when configured with TRAQ_STORAGE_TYPE=local. The /files/{fileId} retrieval endpoint returns user-uploaded SVG or HTML content without adequate security headers or sanitization, causing browsers to render the files directly. An attacker with file-upload privileges can upload malicious files containing JavaScript to trigger XSS in the context of other users who view the file.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or theft of sensitive information stored within the traQ application session.

Recommendation

  • Upgrade traQ to version 3.28.3 or later immediately.
  • For instances where immediate patching is not possible, disable local file storage by modifying the TRAQ_STORAGE_TYPE configuration if feasible, or implement strict Content Security Policy (CSP) headers on the web server hosting the traQ application to restrict the execution of inline scripts and unauthorized sources.
  • Audit logs for the /files/{fileId} endpoint to identify unusual access patterns or requests for files with SVG/HTML extensions from suspicious user agents.
]]>highadvisoryweb-applicationxsscve-2026-63197