CVE-2026-56218 Details

A vulnerability exists in Capgo versions prior to 12.128.2, where uploaded images retain EXIF metadata, including GPS geolocation data. This unstripped metadata can be accessed by downloading the images, allowing extraction of precise latitude and longitude coordinates that reveal the user's physical location at the time the image was taken. The issue arises because EXIF data is not sanitized before images are stored or served, creating a privacy risk by exposing sensitive location information without consent.

Users are advised to update to Capgo version 12.128.2 or later, where this vulnerability has been addressed. For those using earlier versions, it is recommended to manually strip EXIF metadata, especially GPS information, from images before uploading. Additionally, consider using server-side image processing tools to automatically remove sensitive metadata.