Capgo before version 12.128.2 does not remove EXIF metadata – including GPS coordinates – when images are uploaded. This flaw allows an attacker who can retrieve uploaded images to obtain precise latitude and longitude values that identify where a user was at the time the photo was taken, violating privacy and potentially enabling targeted attacks.

The affected product is Capgo, any instance running a version earlier than 12.128.2. No specific subcomponents are listed, so all application deployments that allow image uploads fall under this risk.

The CVSS score is 6.9, indicating a moderate severity. EPSS information is not available and the vulnerability is not in CISA’s KEV catalog. Exploitation requires that an attacker can upload or otherwise obtain access to image files stored by Capgo. Given the public nature of the upload feature, the attack vector is likely remote and does not require privileged access to the system. The attacker can download the images and parse the embedded EXIF data to reveal the user's location.