CVE-2026-56218

CVE-2026-56218CVE-2026-56218

Description

Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download uploaded images and extract precise latitude and longitude coordinates revealing user physical location at capture time.

Scoring

CVSS 5.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Last modified2026-06-20
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.