Path Traversal in TUS Upload Proxy Authorization

Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job's stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo's privileged builder API key. Because the forwarded suffix is never bound to the authorized job's upload_path or upload_session_key, a caller holding a valid 'all' or 'write' Capgo API key with app.build_native permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build's artifacts. All versions are affected; no patch was available at the time of advisory publication.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-100625 is a critical authorization bypass vulnerability in Capgo's native build TUS upload proxy that allows attackers to upload arbitrary files beyond their authorized scope. The vulnerability stems from incomplete path validation—while the system correctly authorizes a caller against a specific build job and validates that job's upload_path, it fails to bind the user-controlled TUS resource suffix to that authorized path when forwarding requests to the builder service. Because Capgo injects its privileged builder API key into these forwarded requests, attackers can traverse beyond their intended upload directory and write files to unauthorized locations on the builder service. This affects any organization using Capgo for mobile app builds, potentially allowing attackers to compromise build artifacts, inject malicious code into applications, or escalate privileges within the build infrastructure.

Casky's 331 matching skills, powered by Claude's extended reasoning capabilities, detect this attack pattern by identifying the interplay between TA0001 (Initial Access—via malicious build uploads) and TA0006 (Credential Access—leveraging the exposed builder API key). Practitioners using Casky would observe findings highlighting: (1) insufficient path canonicalization in upload handlers that don't validate suffix parameters against authorized boundaries, (2) privilege escalation indicators where user-supplied path components reach backend services with elevated credentials, and (3) authorization logic gaps where job-level validation doesn't translate to resource-level enforcement. The skills would flag request chains showing controlled path traversal sequences (e.g., /build/upload/jobId/../../../sensitive) reaching the builder service, combined with API key injection patterns—enabling practitioners to spot similar vulnerabilities in their own upload proxies before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-100625.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-100625

Casky has 331 skills that investigate the attack patterns behind CVE-2026-100625. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn