---
id: CVE-2026-56218
title: Capgo - EXIF Metadata Exposure via Image Upload
summary: >-
  Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation
  data from uploaded images, allowing information disclosure. Attackers can
  download uploaded images and extract precise latitude and longitude
  coordinates reveal…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: Capgo
product: Capgo
affected:
  - Capgo < 12.128.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-23T02:30:44.601316Z'
exploitAvailable: true
published: '2026-06-20'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:37.508Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56218'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-c5w9-886p-9j2x'
    label: GitHub Security Advisory (GHSA-c5w9-886p-9j2x)
  - url: >-
      https://www.vulncheck.com/advisories/capgo-exif-metadata-exposure-via-image-upload
    label: 'VulnCheck Advisory: Capgo - EXIF Metadata Exposure via Image Upload'
tags:
  - cve.org
  - exploit-available
epss: 0.00343
epssPercentile: 0.28005
ingestedAt: '2026-11-08T14:51:22.366Z'
---

## Overview

Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download uploaded images and extract precise latitude and longitude coordinates revealing user physical location at capture time.

## Affected

- `Capgo < 12.128.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.