CVE-2025-57813

traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a vulnerability exists where sensitive information, such as OAuth tokens, are recorded in log files when an error occurs during the execution of an SQL query. An attacker could intentionally trigger an SQL error by methods such as placing a high load on the database. This could allow an attacker who has the authority to view the log files to illicitly acquire the recorded sensitive information. This vulnerability has been patched in version 3.25.0. If upgrading is not possible, a temporary workaround involves reviewing access permissions for SQL error logs and strictly limiting access to prevent unauthorized users from viewing them.

• CWE-532

• https://github.com/traPtitech/traQ/commit/ce5da94f5d5a8348f9ecdc82140b6f53b3721698
• https://github.com/traPtitech/traQ/pull/2787
• https://github.com/traPtitech/traQ/security/advisories/GHSA-27r7-3m9x-r533

Published

Aug 26, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-57808ESPHome is a system to control microcontrollers remotely thr…8.1
• CVE-2025-57809XGrammar is an open-source library for efficient, flexible, …7.5
• CVE-2025-5781Information Exposure Vulnerability in Hitachi Ops Center API…5.2
• CVE-2025-57810jsPDF is a library to generate PDFs in JavaScript. Prior to …7.5
• CVE-2025-57811Craft is a platform for creating digital experiences. From v…7.2
• CVE-2025-57812CUPS is a standards-based, open-source printing system, and …3.7
• CVE-2025-57814request-filtering-agent is an http(s).Agent implementation t…5.5
• CVE-2025-57815Fides is an open-source privacy engineering platform. Prior …6.5
• CVE-2025-57816Fides is an open-source privacy engineering platform. Prior …7.5
• CVE-2025-57817Fides is an open-source privacy engineering platform. Prior …7.2
• CVE-2025-57818Firecrawl turns entire websites into LLM-ready markdown or s…6.3
• CVE-2025-57819FreePBX is an open-source web-based graphical user interface…9.8