Vulnerability GHSA-p74g-f95m-7fx7

Impact

For instances where TRAQ_STORAGE_TYPE is set to local, the file retrieval API /files/{fileId} could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser.

As a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML file and trick a victim into opening the file URL, allowing the attacker to execute arbitrary JavaScript in the victim's browser.

Patches

This issue has been fixed in v3.28.3.

After this fix, the file retrieval API always adds the Content-Disposition header to its responses regardless of the value of the dl query parameter. This prevents user-uploaded files from being displayed directly in the browser.

Workarounds

To mitigate the impact of this issue, apply either of the following workarounds:

• Change TRAQ_STORAGE_TYPE to a storage backend other than local.
• Ensure that all requests to /files/{fileId} include dl=1.

Users of this application can reduce the risk of exploitation by avoiding suspicious file URLs.