Path Traversal Vulnerability in Capgo Product by Capgo
CVE-2026-56233

8.7HIGH

Key Information:

Vendor

Capgo

Status
Capgo
Vendor
CVE Published:
30 June 2026

What is CVE-2026-56233?

Capgo prior to version 12.128.2 suffers from a path traversal vulnerability within the builder upload proxy. This flaw permits authenticated users with build permissions to manipulate upload paths using traversal sequences. These sequences are subsequently normalized by the WHATWG URL parser, allowing unauthorized access to internal administrative endpoints when utilizing the privileged BUILDER_API_KEY header. This vulnerability poses a significant risk as it can lead to unauthorized privilege escalation on the server.

Affected Version(s)

Capgo 0 < 12.128.2

Capgo 12.128.2

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/capgo-ssrf-and-privi...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hunt-with-4bh1
.