Mochidukiyukimi-Wq

Instances configured with `TRAQ STORAGE TYPE=local` can return user-uploaded SVG or HTML content from the '/files/{fileId}' retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser.

OAuth2 silent authorization requests using the `prompt=none` parameter with an empty or omitted `scope` parameter check prior consent against an empty requested scope set, despite all scopes registered for the client becoming eligible for issuance. This allows an attacker controlling an OAuth client to target users who previously consented to only a limited set of scopes and obtain an access token with broader registered scopes without requiring additional consent.