traQ: XSS in the User Uploaded File Retrieval API

Summary

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.

Remediation

1. Inventory every traPtitech traQ deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7
• Referencehttps://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e
• Referencehttps://github.com/traPtitech/traQ/releases/tag/v3.28.3