PT-2026-136336

CVE-2026-63197

Published

2026-11-03

Updated

2026-11-09

Description by

CVSS 3.1

7.3

High

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions traQ versions prior to 3.28.3

Description Instances configured with TRAQ STORAGE TYPE=local can return user-uploaded SVG or HTML content from the '/files/{fileId}' retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser.

Recommendations Update to version 3.28.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-63197