Skip to content

Orphaned File Retention and Continued Access

Moderate
riderx published GHSA-8p92-wcp2-c9j4 Mar 8, 2026

Software

console.capgo.app

Affected versions

< 12.128.2

Patched versions

12.128.2

Description

Summary

When a user uploads a profile image and later replaces or removes it from the profile section, the application does not delete the previously uploaded image from the backend storage. Although the UI reflects that the image has been removed or replaced, the original file remains stored and accessible through its previously generated URL.

This behavior results in orphaned files being retained in storage without user visibility or control.

Impact

  • User-uploaded content persists beyond user intent.
  • Users may assume removed images are no longer stored or accessible.
  • Orphaned files accumulate in storage, potentially increasing storage usage and operational costs.
  • Indicates improper data lifecycle and retention handling.

Root Cause

The application updates the profile image reference at the application/database level but does not delete the previously uploaded object from backend storage.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

Incomplete Cleanup

The product does not properly clean up and remove temporary or supporting resources after they have been used. Learn more on MITRE.

Credits