A path traversal flaw in Capgo’s builder upload proxy allows an authenticated user with build permissions to craft upload paths that navigate outside the intended directory. When the path is processed by the WHATWG URL parser, the traversal sequences are resolved, granting the attacker access to internal administrative endpoints that are normally protected by a privileged BUILDER_API_KEY header. This vulnerability is a CWE‑22 path traversal flaw that turns a benign upload operation into a privileged operation, enabling an attacker to execute arbitrary code or modify system state on the server.

Capgo, specifically the builder upload proxy component. Versions prior to 12.128.2 are affected; any instance running a version earlier than 12.128.2 is vulnerable.

The vulnerability carries a CVSS score of 8.7, indicating substantial severity. EPSS data is unavailable, so the exact likelihood of exploitation in the wild cannot be quantified, but the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated and possess build permissions, making the attack surface more limited than a true remote code execution vulnerability, yet it still provides significant power to an inside threat or a compromised build contributor.