traQ vulnerabilities
CVEs whose affected-version data names the traQ package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-63197High· 7.3traQ: XSS in the User Uploaded File Retrieval API
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct …
▾ TwilighttraPtitech · traQEPSS 0.29%via CVEORG
CVE-2026-63198High· 7.3traQ: Privilege escalation by OAuth prompt=none request
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope …
▾ TwilighttraPtitech · traQEPSS 0.26%via CVEORG