CVE-2026-56218: Capgo EXIF Metadata Disclosure

Technical summary

The vulnerability stems from insufficient input sanitization on the image upload handler in Capgo. The application does not implement EXIF metadata removal during the image processing pipeline, leaving embedded geolocation data—specifically latitude, longitude, and timestamp fields—intact within the stored file. An attacker with network access can retrieve any uploaded image via standard HTTP requests and parse the EXIF headers to extract precise GPS coordinates. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and does not require authentication or user interaction to exploit. The attack surface is the public image download endpoint.

Business impact

This vulnerability exposes users' physical locations at the time photos were taken, creating multiple business risks: user privacy violations that could trigger regulatory scrutiny under GDPR, CCPA, or similar frameworks; potential for location-based stalking, harassment, or physical security threats to users; reputational damage from a confirmed privacy failure; and possible liability if users suffer harm based on exposed location data. Organizations using Capgo to manage user-uploaded imagery should assess whether location disclosure could violate their privacy commitments or user expectations.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability exists in the image upload and storage subsystem and impacts any deployment handling user-generated image content. Capgo 12.128.2 and later versions contain the remediation. No other vendors or products are currently identified as affected by this specific issue.

Exploitability

Exploitability is straightforward and requires no special privileges. An attacker needs only network access to the Capgo instance and knowledge of image URLs (which may be discoverable through enumeration or public sharing). Standard EXIF extraction tools available in most programming languages can parse the geolocation data from downloaded images. The CVSS score of 5.3 (Medium) reflects the low attack complexity and lack of authentication requirement, tempered by the fact that the impact is confidentiality-only and does not allow data modification or system disruption. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update Capgo to version 12.128.2 or later. This release includes EXIF metadata stripping in the image processing pipeline. As an interim measure, if immediate patching is not feasible, restrict access to the image download endpoints or implement a reverse proxy that strips EXIF headers before serving images to users. Additionally, audit any images uploaded to affected versions to determine if they contain sensitive location data that may have been exposed.

Patch guidance

Apply Capgo version 12.128.2 or any subsequent release. Verify the patch by checking the application version number in settings or via API response headers. Test in a non-production environment first to ensure compatibility with your deployment. If you are running Capgo in a containerized environment, rebuild your image with the updated base package version. Once deployed, monitor logs for any image processing errors that may indicate edge cases in the EXIF stripping logic.

Detection guidance

Review logs for image upload timestamps and cross-reference with known user activity to identify which images may have been processed before the patch was applied. Use EXIF metadata extraction tools (e.g., exiftool) on a sample of stored images to verify that GPS data has been removed post-patch. Monitor for suspicious bulk downloads of images from your Capgo instance, which could indicate an attacker attempting to harvest geolocation data. If you suspect images were downloaded while the vulnerability was active, consider notifying affected users about potential location exposure.

Why prioritize this

Although the CVSS score is Medium (5.3), this vulnerability should be prioritized because it directly threatens user privacy and physical safety. Location disclosure is a sensitive category of data loss that regulators and users take seriously. The ease of exploitation combined with the silent nature of the attack—users may not realize their location has been extracted—makes this a meaningful risk even at moderate severity. Organizations handling location-sensitive user bases (healthcare, domestic violence support, activism platforms) should treat this as higher priority.

Risk score, explained

CVSS 5.3 reflects: no authentication required (increases score), network-accessible attack vector (increases score), and low attack complexity (increases score). However, the impact is limited to confidentiality loss with no integrity or availability compromise (decreases score). The scoring does not account for the real-world sensitivity of geolocation data, which security leaders should layer into their risk assessment. Consider adjusting internal priority if your users are in high-risk categories or if your threat model includes state-level actors or stalking scenarios.

Frequently asked questions