EUVD-2026-42256
GHSA-cfvp-cq7v-3cfr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network exploitable with low privilege (platform account required); only partial confidentiality loss via EXIF data; no integrity, availability, or scope-change impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location information and other embedded metadata from uploaded files.
AnalysisAI
Capgo's app information endpoint retains EXIF metadata in uploaded images, leaking sensitive geolocation coordinates and device information to any party with image access. Versions prior to 12.128.2 are affected. An authenticated attacker or any user who can view uploaded app-information images can retrieve full EXIF payloads - including GPS coordinates, timestamps, and device identifiers - from files that the platform should have sanitized. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog; however, the attack requires only low-privilege network access and trivial tooling such as exiftool.
Technical ContextAI
Capgo is an over-the-air (OTA) update and app management platform built on Capacitor, targeting mobile developers. The app information endpoint accepts image uploads (e.g., app icons or marketing assets) but performs no EXIF stripping or metadata sanitization before storing or serving those files. EXIF (Exchangeable Image File Format) metadata is embedded in JPEG and TIFF images by cameras and smartphones and routinely contains GPS latitude/longitude, altitude, camera make/model, software version, and timestamp fields. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) covers this root cause: the application processes user-supplied content and re-exposes it with more information than necessary. The affected version range is all Capgo releases from 0 up to but not including 12.128.2, as recorded in EUVD-2026-42256.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which implements EXIF stripping on image uploads via the app information endpoint. The vendor security advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-62jm-xp28-x4xw should be consulted for upgrade instructions. If immediate upgrade is not feasible, a compensating control is to pre-process all images before upload using a server-side or client-side EXIF stripping library (e.g., libvips, sharp, or piexifjs) to remove metadata before submission; this trades some developer workflow overhead for immediate privacy protection. Restricting access to app information image assets to authenticated and authorized users only limits the exposure window but does not eliminate it for insider-threat scenarios. Organizations should also audit previously uploaded images for residual EXIF data and consider re-uploading sanitized versions after patching.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today