CVE-2026-56298

mediumCVSS 4.3covered by 1 sourcefirst seen 2026-07-08

Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location information and other embedded metadata from uploaded files.

⚡ Watch CVE-2026-56298

Get an email if CVE-2026-56298 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-56298: Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app informatio…nvd · 2026-07-08

External references

NVD record for CVE-2026-56298

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-56298 status](https://www.csirts.com/badge/CVE-2026-56298)](https://www.csirts.com/cve/CVE-2026-56298)