FacturaScripts, an open-source ERP application, has a sensitive information disclosure vulnerability in its Library module. The application does not strip EXIF or other embedded metadata from user-uploaded images before storing and serving them. This allows any authenticated user with access to the Library to download images containing metadata such as GPS coordinates, device details, timestamps, and personal comments, potentially exposing sensitive personal information like an employee's home address.