PT-2026-51146 · Cap Go · Cap-Go

Penetest + 1 · Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56218

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description The software fails to strip EXIF metadata, which includes GPS geolocation data, from uploaded images. This leads to information disclosure, as attackers can download these images and extract precise latitude and longitude coordinates to reveal the physical location of the user at the time the image was captured.

Recommendations Update to version 12.128.2 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-56218

Affected Products

Cap-Go

References · 5

• https://github.com/Cap-go/capgo/security/advisories/GHSA-c5w9-886p-9j2x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56218 · Security Note
• https://vulncheck.com/advisories/capgo-exif-metadata-exposure-via-image-upload · Note
• https://twitter.com/infoflowcloud/status/2068467958704202152 · Twitter Post
• https://twitter.com/CVEnew/status/2068466537430729139 · Twitter Post