medium5.3
CVE-2026-56218
Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure.
Impact
Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download uploaded images and extract precise latitude and longitude coordinates revealing user physical location at capture time.
Affected products
| Product | Affected versions |
|---|---|
| Capgo | before 12.128.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.