VYPR
Medium severity5.9OSV Advisory· Published Aug 26, 2025· Updated Apr 15, 2026

CVE-2025-57813

CVE-2025-57813

Description

traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a vulnerability exists where sensitive information, such as OAuth tokens, are recorded in log files when an error occurs during the execution of an SQL query. An attacker could intentionally trigger an SQL error by methods such as placing a high load on the database. This could allow an attacker who has the authority to view the log files to illicitly acquire the recorded sensitive information. This vulnerability has been patched in version 3.25.0. If upgrading is not possible, a temporary workaround involves reviewing access permissions for SQL error logs and strictly limiting access to prevent unauthorized users from viewing them.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/traPtitech/traQGo
< 3.25.03.25.0

Affected products

1
  • Range: v0.1.0-alpha.0, v1.0.0-rc.0, v1.0.0-rc.1, …

Patches

1
ce5da94f5d5a

Merge pull request #2787 from traPtitech/fix/gorm-level-silent

https://github.com/traptitech/traqRyugo TakemuraAug 25, 2025via osv
1 file changed · +2 1
  • cmd/serve.go+2 1 modified
    @@ -12,6 +12,7 @@ import (
     	"github.com/spf13/cobra"
     	"go.uber.org/zap"
     	"golang.org/x/sync/errgroup"
    +	gormlogger "gorm.io/gorm/logger"
     
     	"github.com/traPtitech/traQ/event"
     	"github.com/traPtitech/traQ/repository"
    @@ -57,7 +58,7 @@ func serveCommand() *cobra.Command {
     			if err != nil {
     				logger.Fatal("failed to connect database", zap.Error(err))
     			}
    -			engine.Logger = gormzap.New(logger.Named("gorm"))
    +			engine.Logger = gormzap.New(logger.Named("gorm")).LogMode(gormlogger.Silent)
     			db, err := engine.DB()
     			if err != nil {
     				logger.Fatal("failed to get *sql.DB", zap.Error(err))
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.