Capgo versions before 12.128.2 accept image uploads for app information without removing embedded EXIF metadata. Attackers can embed geolocation or other sensitive data in an image and, once the image is stored, exfiltrate that metadata via normal API calls. This flaw is classified as CWE‑200, an information‑disclosure weakness that can reveal private data such as device location to unauthorized parties.

Any Capgo deployment running a version older than 12.128.2 is susceptible. The issue is localized to the image upload endpoint used for app information, which is part of the core API that is generally accessible to the public or to authenticated users. All installations of Capgo that have not applied the fix before release 12.128.2 are affected.

The CVSS score of 5.3 indicates a medium‑severity vulnerability; the EPSS score of <1% suggests a low probability of exploitation, and the vulnerability is not yet listed in CISA’s KEV catalog. Based solely on the description, the attack vector appears to be remote: an attacker sends a crafted image to the upload endpoint to embed EXIF metadata. If the endpoint is unauthenticated or only lightly protected, the image can be stored and later retrieved by the attacker or others with access to the resource, resulting in the disclosure of location and potentially other sensitive information.