GHSA-p74g-f95m-7fx7
Suggest an improvement- Source
- https://github.com/advisories/GHSA-p74g-f95m-7fx7
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-p74g-f95m-7fx7/GHSA-p74g-f95m-7fx7.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-p74g-f95m-7fx7
- Aliases
- Published
- 2026-11-09T20:52:49Z
- Modified
- 2026-11-09T21:00:04Z
- Severity
-
- 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- traQ: XSS in the User Uploaded File Retrieval API
- Details
-
Impact
For instances where
TRAQ_STORAGE_TYPEis set tolocal, the file retrieval API/files/{fileId}could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser.As a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML file and trick a victim into opening the file URL, allowing the attacker to execute arbitrary JavaScript in the victim's browser.
Patches
This issue has been fixed in v3.28.3.
After this fix, the file retrieval API always adds the
Content-Dispositionheader to its responses regardless of the value of thedlquery parameter. This prevents user-uploaded files from being displayed directly in the browser.Workarounds
To mitigate the impact of this issue, apply either of the following workarounds:
- Change
TRAQ_STORAGE_TYPEto a storage backend other thanlocal. - Ensure that all requests to
/files/{fileId}includedl=1.
Users of this application can reduce the risk of exploitation by avoiding suspicious file URLs.
- Change
- Database specific
{ "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-11-09T20:52:49Z", "nvd_published_at": "2026-11-03T19:18:08Z", "severity": "HIGH" }- References
Affected packages
Go / github.com/traPtitech/traQ
Package
- Name
- github.com/traPtitech/traQ
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/traPtitech/traQ