Compliance Impact

This vulnerability allows authenticated users to access images containing embedded metadata with personally identifiable information (PII), such as GPS coordinates, device information, timestamps, and comments. Such exposure of PII can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require the protection of personal data and restrict unauthorized access or disclosure.

Specifically, the inadvertent disclosure of sensitive location data (e.g., an employee's home address) to all users with Library download access increases the risk of violating privacy requirements mandated by these standards.

Therefore, until fixed in version 2026, this vulnerability posed a significant risk to compliance with common data protection regulations by failing to adequately protect PII embedded in image metadata.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Library module of FacturaScripts, an open source accounting and invoicing software. In versions prior to 2026, the module stores and serves uploaded images without removing embedded metadata such as EXIF, XMP, and IPTC data.

Any authenticated user who downloads an image can extract sensitive metadata embedded by the uploader, including GPS coordinates, device information, timestamps, comments, thumbnail previews, and other personally identifiable information (PII).

This happens because the Library module allows unrestricted uploads, persistent storage, authenticated download access, and does not sanitize metadata on the server side.

For example, an employee uploading a photo taken at their home could inadvertently disclose their precise home address to every user with access to download images from the Library.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unintended disclosure of sensitive personal information embedded in image metadata to unauthorized or unintended users within the system.

• Exposure of GPS coordinates can reveal precise physical locations such as home addresses.
• Device information and timestamps can be used to track user behavior or identify individuals.
• Embedded comments or notes may contain confidential or private information.

Overall, this can compromise user privacy and potentially lead to security risks related to the exposure of personally identifiable information (PII).

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade FacturaScripts to version 2026 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unstripped image metadata (EXIF/XMP/IPTC) being stored and served by the Library module in FacturaScripts versions prior to 2026. To detect this vulnerability on your system or network, you can check if images downloaded from the Library module contain embedded metadata such as GPS coordinates, device information, timestamps, or other personally identifiable information.

One way to detect this is by downloading images from the Library module and inspecting their metadata using common command-line tools.

• Use the 'exiftool' command to inspect image metadata: exiftool image.jpg
• Alternatively, use 'identify' from ImageMagick to check for metadata: identify -verbose image.jpg
• If you find GPS or other sensitive metadata in images served by the Library module, your system is likely affected by this vulnerability.

Useful 0 Not Useful 0