CVE-2026-56298: Capgo EXIF Metadata Exposure in Image Uploads

Technical summary

The vulnerability stems from insufficient sanitization of uploaded image files in Capgo's app information endpoint. EXIF (Exchangeable Image File Format) metadata is a standardized format embedded in image files that can contain GPS coordinates, camera make/model, timestamps, and other technical parameters. The application fails to strip or validate this metadata during the upload process, allowing an attacker with valid credentials to retrieve geolocation and other sensitive data through uploaded image inspection. The issue is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), reflecting the unintended disclosure of private geographic and device metadata.

Business impact

Organizations using Capgo may inadvertently expose the physical locations where photos are taken or stored, potentially compromising operational security, employee safety, or facility locations. This is particularly concerning for remote teams, field personnel, or organizations handling sensitive projects where geolocation data could reveal infrastructure locations or work patterns. The exposure is indirect—it requires an authenticated attacker to upload images and extract metadata—but the information loss could inform physical reconnaissance or social engineering campaigns. The medium severity rating reflects the requirement for prior authentication and the confidentiality (rather than integrity or availability) impact.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability is triggered specifically through the app information endpoint when images are uploaded. Any deployment running an affected version that permits users to upload images through this endpoint is at risk. No information about specific operating systems or deployment contexts is provided; the issue appears to affect the application across all deployments.

Exploitability

Exploitation requires valid authentication credentials to access the app information endpoint and upload images. The attack is straightforward once authenticated: craft or obtain an image with EXIF metadata containing geolocation data, upload it via the endpoint, and retrieve or inspect the metadata. No special tools, user interaction, or complex attack chains are needed. The CVSS score of 4.3 (Medium) reflects the low attack complexity and low privilege requirement (authenticated user), offset by the limited impact (confidentiality only) and the requirement for valid credentials (not unauthenticated).

Remediation

Upgrade Capgo to version 12.128.2 or later. This version implements proper EXIF metadata stripping on uploaded images. Organizations should verify the patch version against the official Capgo release notes to confirm the fix is included. As an interim mitigation, restrict access to the app information endpoint to only trusted users or disable image upload functionality if not required for operations.

Patch guidance

Apply Capgo version 12.128.2 or later as soon as feasible. The patch directly addresses EXIF metadata handling in the upload process. Organizations should test the patch in a staging environment to confirm compatibility with existing workflows before production deployment. Verify against the official Capgo advisory that the deployed version is 12.128.2 or newer and review release notes to confirm EXIF stripping is enabled by default.

Detection guidance

Monitor application logs for image uploads to the app information endpoint. Inspect uploaded image files for EXIF metadata using standard tools (e.g., exiftool, ImageMagick identify). Search for images containing GPS coordinates or timestamp data in your Capgo instance. Check user access patterns to the image upload endpoint for suspicious frequency or timing. Review file storage locations where uploaded images are persisted to identify any with embedded geolocation markers.

Why prioritize this

While this vulnerability carries a medium CVSS score, prioritization depends on your environment. If field teams, remote workers, or sensitive-location operations regularly upload photos through Capgo, prioritize the patch to prevent location disclosure. If the app information endpoint is used primarily for administrative purposes by a limited set of trusted internal users, the immediate risk is lower, though patching remains prudent. The lack of CISA KEV status (not currently exploited in the wild at scale) suggests this is not an active threat in the immediate threat landscape, but the simplicity of exploitation warrants timely remediation.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects: (1) network-accessible endpoint (AV:N), (2) low attack complexity with no special conditions required (AC:L), (3) requirement for valid login credentials (PR:L), (4) no user interaction needed to exploit (UI:N), (5) confidentiality impact only—geolocation and metadata leak without affecting system integrity or availability (C:L/I:N/A:N). The rating appropriately captures that this is an information disclosure issue requiring prior authentication rather than a critical system compromise.

Frequently asked questions