CVE-2026-53867

5.3 mediumEPSS 0.2%

Medium (5.3). EPSS 0.2% chance of exploitation in the next 30 days.

Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-31)
CWE: CWE-459
Published: 2026-06-12
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-8p92-wcp2-c9j4
https://www.vulncheck.com/advisories/capgo-orphaned-file-retention-via-profile-image-replacement

Check your stack JSON