traQ XSS in user-uploaded file retrieval
Messenger servers storing files locally let attackers run hidden actions in other users' browsers.
Summary
traQ is a messenger application. When configured with local file storage, uploaded SVG or HTML files render directly in the browser, so an attacker with upload permission can run JavaScript in another user's browser after inducing them to open the file URL.
Affected when
- Local file storage set with TRAQ_STORAGE_TYPE=local
What to do
Update to traQ 3.28.3 or later.
Products and platforms
CVE IDs
Times
First published
First seen