FacturaScripts, an open source accounting and invoicing software by NeoRazorX, had a vulnerability (CVE-2026-27892) in versions before 2026 where the Library module stored and served uploaded images without removing embedded EXIF/XMP/IPTC metadata. This metadata included sensitive information such as GPS coordinates, device information, timestamps, comments, and thumbnails. Any authenticated user with download access to the Library module could extract this data, leading to exposure of personally identifiable information. The vulnerability arises from the combination of unrestricted uploads, persistent storage, authenticated download access, and lack of server-side metadata sanitization. The issue is resolved in version 2026.

The vulnerability allows unauthorized disclosure of sensitive metadata embedded in images uploaded to the Library module. This can lead to privacy breaches, such as revealing precise physical locations (e.g., home addresses) of employees or other individuals who uploaded images. The confidentiality of personal information is compromised, but there is no indication of impact on integrity or availability. The CVSS score of 6.5 reflects a medium severity with high confidentiality impact and low complexity for exploitation by authenticated users.

This vulnerability is fixed in FacturaScripts version 2026. Users should upgrade to version 2026 or later to ensure that image metadata is properly sanitized on upload. Since no official patch link or advisory is provided, verify the upgrade availability from the vendor's official channels. Until upgraded, restrict Library module download access to trusted users only and consider manual metadata removal before uploading images.