CVE-2026-100625
Received Received - Intake

Path Traversal in Capgo Native Build TUS Upload Proxy

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job's stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo's privileged builder API key. Because the forwarded suffix is never bound to the authorized job's upload_path or upload_session_key, a caller holding a valid 'all' or 'write' Capgo API key with app.build_native permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build's artifacts. All versions are affected; no patch was available at the time of advisory publication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100625
EUVD
EUVD-2026-87720

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
capgo capgo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100625 is an authorization bypass vulnerability in Capgo's build upload proxy. The proxy checks if a user has permission for a specific build job but then forwards arbitrary TUS upload paths to the builder service using Capgo's privileged API key. This allows an attacker with a valid Capgo API key to write to another user's TUS upload resource by manipulating the path suffix, potentially corrupting build artifacts.

Detection Guidance

To detect this vulnerability, inspect Capgo's build upload proxy logs for unauthorized TUS resource writes. Check for requests where the TUS resource suffix does not match the authorized build job ID. Look for repeated failed attempts to access build artifacts or unexpected API key usage across different jobs.

Impact Analysis

This vulnerability allows attackers with a valid Capgo API key to corrupt build artifacts, cause denial of service, or gain unauthorized access to other users' build resources. It could lead to compromised applications, data loss, or disruption of services relying on Capgo's build system.

Compliance Impact

This vulnerability could lead to unauthorized access or corruption of sensitive data, potentially violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance may be impacted if build artifacts contain regulated data.

Mitigation Strategies

Immediately restrict Capgo API keys to least privilege. Disable the build upload proxy if not essential. Monitor for unauthorized TUS resource writes and block suspicious suffix patterns. Contact Capgo support for patch availability or implement a custom fix binding TUS paths to authorized jobs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart