Vulnerability Description
Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling access to internal administrative endpoints with the privileged BUILDER_API_KEY header and resulting in server-side privilege escalation.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Cap-go/capgo/security/advisories/GHSA-qprp-873h-mx6f
- https://www.vulncheck.com/advisories/capgo-ssrf-and-privilege-escalation-via-pat
- https://github.com/Cap-go/capgo/security/advisories/GHSA-qprp-873h-mx6f
FAQ
What is CVE-2026-56233?
CVE-2026-56233 is a vulnerability with a CVSS score of 8.3 (HIGH). Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append tra...
How severe is CVE-2026-56233?
CVE-2026-56233 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56233?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.