FacturaScripts <v2025.81 Image EXIF Metadata Leakage Vulnerability (CVE-2026-7782)

Vulnerability Summary: Unstripped Image Metadata Leakage in NeoRazorX/facturascripts Vulnerability Overview Vulnerability Name: Unstripped Image Metadata (EXIF) Leakage (CVE-2026-7782) Vulnerability Type: Information Disclosure Severity: Medium (CVSS 6.5/10) Affected Versions: Fixed Versions: Description: The "Library" module in Factura Scripts fails to perform server-side metadata scrubbing when uploading and downloading images. After an attacker uploads an image containing sensitive metadata such as GPS coordinates, device information, and timestamps, any user with download permissions can retrieve the image and extract this private information. Impact Scope Affected Module: Library module (supports full image upload, persistent storage, and direct download). Leaked Data: GPS Coordinates: Precise physical location (e.g., home address). Device Information: Phone model, serial number, software version. User Comments: May contain PII such as names and remarks. Thumbnails: May retain the original uncropped image. Risk Scenarios: Employees inadvertently leaking home addresses via uploaded photos; malicious insider actors exploiting this vulnerability for physical security threats or behavioral profiling. Remediation Plan Short-term Fixes: 1. Force the stripping of all EXIF and metadata during the image upload processing logic in the Library module. 2. Perform batch metadata cleanup for existing images in the library. 3. Extend the metadata stripping logic to all other upload endpoints within the application (e.g., email attachments, profile photos). Long-term Architecture: 1. Establish a centralized file upload processing pipeline to ensure consistent metadata scrubbing across all modules. 2. Implement Content Security Policy (CSP) and headers to mitigate inline rendering risks. 3. Implement configurable metadata policies (e.g., retaining only orientation data, or stripping all metadata). POC Code and Usage Examples 1. Constructing a Test Image with Metadata (Shell) Inject GPS and description information using : 2. Verifying Metadata Extraction (Shell) After downloading the image, view the leaked information using : Expected Output (when vulnerability exists): 3. Suggested Code Implementation for Fix PHP (using built-in GD library): PHP (using Imagick): Python: Command Line (Batch Cleanup):**

Goal Reached Thanks to every supporter — we hit 100%!

FacturaScripts <v2025.81 Image EXIF Metadata Leakage Vulnerability (CVE-2026-7782)

More from this source