Vendor

TraP

1 brief RSS

traQ: Stored cross-site scripting via file upload (CVE-2026-63197)

The traQ messenger application prior to version 3.28.3 is vulnerable to stored cross-site scripting (XSS) when configured with TRAQ_STORAGE_TYPE=local, allowing attackers to upload crafted SVG or HTML files for unauthorized JavaScript execution in a victim's browser.

traQ web-application xss cve-2026-63197

1t 1c 1d ago