CVE-2026-56298CWE-200

Capgo - EXIF Metadata Exposure in App Information Image Upload

Medium · published July 8, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location information and other embedded metadata from uploaded files.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-07-08T13:49Z
EPSS history
Timeline
  • 08 JUL 13:49Z
    Capgo - EXIF Metadata Exposure in App Information Image Upload
    cvelistv5