VULNERABILITY INTELLIGENCE
CVE-2026-56218
CVSS score6.9 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2026-06-20
Last modified2026-06-23
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download uploaded images and extract precise latitude and longitude coordinates revealing user physical location at capture time.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor