CVE-2026-63197: traQ: XSS in the User Uploaded File Retrieval API

### Impact For instances where `TRAQ_STORAGE_TYPE` is set to `local`, the file retrieval API `/files/{fileId}` could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered directly in the browser. As a result, an attacker who can upload files to traQ could upload a crafted SVG or HTML file and trick a victim into opening the file URL, allowing the attacker to execute arbitrary JavaScript in the victim's browser. ### Patches This issue has been fixed in v3.28.3. After this fix, the file retrieval API always adds the `Content-Disposition` header to its responses regardless of the value of the `dl` query parameter. This prevents user-uploaded files from being displayed directly in the browser. ### Workarounds To mitigate the impact of this issue, apply either of the following workarounds: * Change `TRAQ_STORAGE_TYPE` to a storage backend other than `local`. * Ensure that all requests to `/files/{fileId}` include `dl=1`. Users of this application can reduce the risk of exploitation by avoiding suspicious file URLs.