CVE-2026-56233

HIGH

Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy

Title source: cna

Description

Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling access to internal administrative endpoints with the privileged BUILDER_API_KEY header and resulting in server-side privilege escalation.

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory

GitHub Security Advisory (GHSA-qprp-873h-mx6f)

https://github.com/Cap-go/capgo/security/advisories/GHSA-qprp-873h-mx6f

Third Party Advisory third-party-advisory

VulnCheck Advisory: Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy

https://www.vulncheck.com/advisories/capgo-ssrf-and-privilege-escalation-via-path-traversal-in-builder-upload-proxy

Scores

CVSS v3 8.3

EPSS 0.0045

EPSS Percentile 37.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (2)

Capgo/Capgo < 12.128.2

Capgo/Capgo 12.128.2

Published Jun 30, 2026

Tracked Since Jul 01, 2026