Is CVE-2026-63197 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63197 being exploited in the wild.

How severe is CVE-2026-63197?

High severity, with a CVSS score of 7.3, published 3 November 2026.

Which products and versions are affected?

github.com/traPtitech/traQ (Go) < 1.0.0-rc.2.0.20260627142846-3db29e777166, SEMVER:introduced=0,fixed=1.0.0-rc.2.0.20260627142846-3db29e777166; traP traQ prior to 3.28.3.

Is there a fix for CVE-2026-63197?

Yes. github.com/traPtitech/traQ (Go): upgrade to 1.0.0-rc.2.0.20260627142846-3db29e777166 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63197 attacked?

It is attacked over the network.

Am I affected by CVE-2026-63197?

Check whether you run github.com/traPtitech/traQ (Go) or traP traQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63197: traQ stored XSS in file retrieval endpoint

Q: Is there a fix for CVE-2026-63197?

Yes. github.com/traPtitech/traQ (Go): upgrade to 1.0.0-rc.2.0.20260627142846-3db29e777166 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-63197 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-63197?

Check whether you run github.com/traPtitech/traQ (Go) or traP traQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63197 · Severity: high · CVSS 7.3 · Published 2026-11-03

traQ is a messenger application for the Digital Creators Club. When configured with local file storage, the application serves user-uploaded SVG and HTML files directly in the browser, allowing an attacker to upload malicious content and trick other users into viewing it, resulting in the execution of arbitrary JavaScript in their browsers.

Technologies: github.com/traPtitech/traQ (Go). Vendors: Go.

Quick answers

Is CVE-2026-63197 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63197 being exploited in the wild.
How severe is CVE-2026-63197?: High severity, with a CVSS score of 7.3, published 3 November 2026.
Which products and versions are affected?: github.com/traPtitech/traQ (Go) < 1.0.0-rc.2.0.20260627142846-3db29e777166, SEMVER:introduced=0,fixed=1.0.0-rc.2.0.20260627142846-3db29e777166; traP traQ prior to 3.28.3.
Is there a fix for CVE-2026-63197?: Yes. github.com/traPtitech/traQ (Go): upgrade to 1.0.0-rc.2.0.20260627142846-3db29e777166 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63197 attacked?: It is attacked over the network.
Am I affected by CVE-2026-63197?: Check whether you run github.com/traPtitech/traQ (Go) or traP traQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/traPtitech/traQ (Go): upgrade to 1.0.0-rc.2.0.20260627142846-3db29e777166 or later
```
go get github.com/traPtitech/traQ@v1.0.0-rc.2.0.20260627142846-3db29e777166
```

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the /files/{fileId} endpoint. Instances configured with TRAQ_STORAGE_TYPE=local fail to set the Content-Disposition header to force download, allowing SVG and HTML files to render directly in the browser. An authenticated user can upload crafted active content, and when another user retrieves the file URL, the attacker's JavaScript executes in the victim's browser context.

Affected products

traP traQ prior to 3.28.3

Identifiers

CVE-2026-63197
GHSA-p74g-f95m-7fx7

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.