Executive brief
Capgo, a platform used for managing app updates and configurations, failed to remove sensitive location data from images uploaded by users. This means that anyone who can view or download these images can see the exact GPS coordinates where the photo was taken, as well as details about the device used. This flaw poses a significant privacy risk to users and could lead to regulatory compliance issues regarding personal data protection.
Technical details
Capgo versions prior to 12.128.2 contain an information disclosure vulnerability due to improper sanitization of uploaded image files. The application fails to strip EXIF metadata, specifically GPS latitude and longitude coordinates, device models, and timestamps, from images uploaded to the personal image feature (e.g., account settings). An unauthenticated remote attacker can download these publicly accessible or shared images and use standard tools to extract the embedded metadata. This issue stems from a lack of server-side image processing to remove sensitive tags before storage and redistribution. The vulnerability is addressed in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-02-10: advisory: Initial GitHub security advisory published
- 2026-06-20: disclosed: CVE published to NVD dataset