CVE-2026-56233

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description A path traversal issue exists in the builder upload proxy. Authenticated users with build permissions can bypass upload restrictions by appending traversal sequences to the upload path. These sequences are normalized by the WHATWG URL parser, allowing unauthorized access to internal administrative endpoints using the privileged BUILDER API KEY header, which leads to server-side privilege escalation.

Recommendations Update to version 12.128.2 or later.