traQ CVE-2026-63197

Exploitation requires the traQ instance to be configured with TRAQ_STORAGE_TYPE=local; on any other storage backend the /files/{fileId} endpoint does not render user files inline and the flaw does not apply. The attacker must hold an account with file-upload capability (authenticated, PR:L) to stage a crafted SVG or HTML file, and the victim must actively open the attacker's file URL (UI:R), so there is no unauthenticated or zero-interaction path. Confirmed limiting factors per the advisory: the vendor-provided workarounds of switching away from the 'local' storage backend, or ensuring all /files/{fileId} requests include dl=1, neutralize the issue, and upgrading to 3.28.3 (which always sets Content-Disposition: attachment) is the complete fix.

This is a moderate, conditional risk rather than a widespread emergency. The provided CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3) indicates a network-reachable stored-XSS flaw that requires an authenticated account with file-upload capability (PR:L) and victim interaction (UI:R) - so exploitation is not drive-by. The vuln.today decision label is 'this_week', indicating prioritized but not immediate action. There is no CISA KEV listing and no EPSS score in the supplied data, so exploitation probability cannot be quantified from these sources; combined with the absence of any PoC reference, exploitation status is best described as no public exploit identified at time of analysis. The signal that most constrains real-world risk is the narrow precondition: the flaw only manifests when TRAQ_STORAGE_TYPE is set to 'local'. The affected product (traPtitech/traQ) is a niche, club-oriented self-hosted messenger, which further limits aggregate exposure. Net: a genuine XSS worth patching in the referenced timeframe, but its impact is gated by authentication, user interaction, and a specific storage configuration rather than being broadly wormable.

An authenticated traQ user on an instance configured with TRAQ_STORAGE_TYPE=local uploads a crafted SVG or HTML file containing malicious JavaScript, then shares or tricks another user into opening that file's /files/{fileId} URL. Because the retrieval endpoint served such files for direct in-browser rendering (pre-3.28.3), the victim's browser executes the attacker's JavaScript in the traQ origin, enabling session/account compromise. No public exploit was identified in the supplied data; the low attack complexity (AC:L) means crafting the active-content file is trivial, but the required user interaction (UI:R) still gates the attack.