Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/traPtitech/traQ

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9GoPublished

    traQ Allows Insertion of Sensitive Information into Log File

    CVE-2025-57813 · GHSA-27r7-3m9x-r533

    Affected
    • Go github.com/traPtitech/traQ < 3.25.0
    Fixed in
    3.25.0· Vendor fix available
    Issue
    Impact A vulnerability exists where sensitive information, such as OAuth tokens, is recorded in log files when an error occurs during the execution of an SQL query. An attacker could intentionally trigger an SQL error by methods such as placing a high load on the database. This could allow an attacker who has the authority to view the log files to illicitly acquire the recorded sensitive information. Patch This vulnerability was temporarily fixed by #2787 and will be completely resolved by #2788. This issue may have caused OAuth tokens to be leaked to users who can view logs on traQ instances using versions prior to v3.25.0. While it is possible that OAuth tokens for both human users and Bots were leaked, revoking Bot access tokens is not recommended as it may cause errors. This issue will be resolved in a future update. Currently, the recommended mitigation is to invalidate the OAuth tokens of human users only. To apply this measure, please execute the following SQL statement…

    Recommended action: Upgrade to 3.25.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →