CVE-2026-56298: Capgo - EXIF Metadata Exposure in App Information Image Upload
Published Jul 8, 2026
·Updated
Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location information and other embedded metadata from uploaded files.
Affected Software
1 affected component
Capgo Capgo<12.128.2
Event History
Jul 8, 2026
CVE Published
via MITRE·01:49 PM
Data Sourced
via MITRE·01:49 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-56298?
CVE-2026-56298 has a medium severity rating of 5.3.
2
How do I fix CVE-2026-56298?
To fix CVE-2026-56298, update to Capgo version 12.128.2 or later.
3
What type of vulnerability is CVE-2026-56298?
CVE-2026-56298 is classified as an information leakage vulnerability due to EXIF metadata exposure.
4
What data is exposed by CVE-2026-56298?
CVE-2026-56298 exposes sensitive geolocation data and other embedded metadata from uploaded images.
5
Who is affected by CVE-2026-56298?
Users of Capgo versions prior to 12.128.2 are affected by CVE-2026-56298.