Medium severity5.3NVD Advisory· Published Jun 20, 2026· Updated Jun 23, 2026

CVE-2026-56218

Description

Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download uploaded images and extract precise latitude and longitude coordinates revealing user physical location at capture time.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cap Go/Capgollm-fuzzy
Range: <12.128.2
Cap Go/Capgo.appllm-fuzzy
Range: <12.128.2

Patches

Vulnerability mechanics

References

github.com/Cap-go/capgo/security/advisories/GHSA-c5w9-886p-9j2xnvd
www.vulncheck.com/advisories/capgo-exif-metadata-exposure-via-image-uploadnvd

News mentions

Capgo: 21 CVEs Disclosed Together — Unauthenticated Cross-Tenant Bugs and Scope Escalation Lead the Batch
Vypr Intelligence · Jun 20, 2026

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000