CVE-2026-56233

Received Received - Intake

BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling access to internal administrative endpoints with the privileged BUILDER_API_KEY header and resulting in server-side privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56233

EUVD

EUVD-2026-40428

Affected Vendors & Products

Vendor	Product	Version / Range
capgo	capgo	to 12.128.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 and involves a path traversal issue in the builder upload proxy.

Authenticated users with build permissions can exploit this by appending traversal sequences to the upload path. These sequences are normalized by the WHATWG URL parser, which allows attackers to bypass upload restrictions.

As a result, attackers can access internal administrative endpoints using the privileged BUILDER_API_KEY header, leading to server-side privilege escalation.

Impact Analysis

This vulnerability can lead to server-side privilege escalation, allowing an attacker with build permissions to gain unauthorized administrative access.

Such unauthorized access can compromise the integrity and security of the system, potentially leading to data breaches, unauthorized modifications, or disruption of services.

Hi! I’m here to help you understand CVE-2026-56233. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70