Skip to content
OpenAdvisories

Package · Go

github.com/traPtitech/traQ

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.3
    CVE-2026-63198

    traQ: Privilege escalation by OAuth prompt=none request

    traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all sc…

    traPtitech traQ github.com/traPtitech/traQ Go
  • High 7.3
    CVE-2026-63197

    traQ: XSS in the User Uploaded File Retrieval API

    traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An …

    traPtitech traQ github.com/traPtitech/traQ Go