CVE-2026-56233: Capgo Path Traversal Vulnerability

CVE-2026-56233 Overview

CVE-2026-56233 is a path traversal vulnerability in Capgo versions before 12.128.2. The flaw resides in the builder upload proxy, where authenticated users holding build permissions can append traversal sequences to the upload path. The WHATWG URL parser normalizes these sequences, enabling the request to reach internal administrative endpoints. Because the proxy forwards the privileged BUILDER_API_KEY header, attackers gain server-side privilege escalation and can invoke administrative functionality reserved for the platform. The issue is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated attackers with build permissions can bypass upload restrictions, reach internal admin endpoints, and escalate privileges on the Capgo server.

Affected Products

Capgo versions prior to 12.128.2
Capgo builder upload proxy component
Self-hosted Capgo deployments exposing the builder API

Discovery Timeline

2026-06-30 - CVE-2026-56233 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-56233

Vulnerability Analysis

The vulnerability sits in the builder upload proxy handler in Capgo. The handler accepts an upload path from an authenticated caller and constructs a request to an internal service. Before dispatching the request, the code normalizes the target URL using the WHATWG URL parser. That parser collapses sequences such as ../ during resolution, which lets attacker-supplied traversal payloads rewrite the effective request path. The proxy then forwards the request with the privileged BUILDER_API_KEY header attached, granting the caller the same trust level as the internal builder service. This is a combination of path traversal and server-side request forgery that yields privilege escalation within the application.

Root Cause

The root cause is insufficient validation of the upload path before URL normalization. The upload proxy trusts that the path segment cannot escape the intended prefix. Because WHATWG URL parsing resolves .. segments after concatenation, traversal characters allow the request to target arbitrary internal endpoints. Any endpoint that trusts the BUILDER_API_KEY header becomes reachable to any authenticated user with build permissions.

Attack Vector

An attacker authenticates with an account that holds build permissions. The attacker then issues an upload request whose path contains traversal sequences appended to the expected prefix. The proxy normalizes the URL, resolves the traversal, and forwards the request to an internal administrative endpoint with the privileged API key header. See the GitHub Security Advisory GHSA-qprp-873h-mx6f and the VulnCheck Advisory on SSRF for full details.

Detection Methods for CVE-2026-56233

Indicators of Compromise

Requests to the builder upload proxy containing ../, ..%2F, or encoded traversal sequences in the path parameter
Unexpected internal admin endpoint invocations correlated with the BUILDER_API_KEY header
Build-permission accounts issuing upload requests to non-standard resource paths
Sudden creation, modification, or role changes originating from build service accounts

Detection Strategies

Inspect reverse proxy and application logs for upload paths containing traversal patterns after URL decoding
Alert on any outbound proxy request whose resolved path differs from its raw path prefix
Correlate use of BUILDER_API_KEY with source request identity to detect scope mismatch

Monitoring Recommendations

Enable verbose request logging on the Capgo builder upload proxy including raw and normalized paths
Monitor administrative endpoints for callers that are not internal builder services
Track privilege changes and configuration writes attributable to build-role accounts

How to Mitigate CVE-2026-56233

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later without delay
Rotate the BUILDER_API_KEY and any credentials that transited the vulnerable proxy
Audit accounts with build permissions and remove unused or over-privileged users
Review recent administrative actions for signs of unauthorized invocation

Patch Information

Upgrade to Capgo 12.128.2 or later. The maintainers published the fix in the GitHub Security Advisory GHSA-qprp-873h-mx6f. The fix enforces strict validation of the upload path before URL construction so that traversal sequences cannot alter the target endpoint.

Workarounds

Restrict network access to internal administrative endpoints so they cannot be reached from the builder proxy host
Reject any request to the upload proxy whose path contains .., %2e%2e, or backslash sequences at a web application firewall
Temporarily revoke build permissions from non-essential accounts until the patch is applied

bash

# Example WAF rule to block traversal on the upload proxy path
# ModSecurity-style rule
SecRule REQUEST_URI "@rx /builder/upload/.*(\.\./|%2e%2e/|%2e%2e%2f)" \
  "id:1056233,phase:1,deny,status:400,\
   msg:'CVE-2026-56233 Capgo builder upload path traversal attempt'"