# CVE-2025-13785: yungifez Skuul School Management System sensitive data exposure in image uploads

Source: https://junglewise.ai/threats/cve-2025-13785-yungifez-skuul-school-management-system-sensitive-data-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-13785 · Severity: medium · CVSS 4.3 · Published 2025-11-30

Skuul is a web-based school management system used to manage student, teacher, and parent accounts and communications. The system fails to strip EXIF metadata from uploaded profile images, allowing attackers to extract sensitive information such as GPS coordinates, device details, and timestamps from any publicly accessible image. This could expose user location data and personal device information, creating privacy violations and potential regulatory compliance issues.

Technologies: [yungifez/skuul (Packagist)](https://junglewise.ai/threats/technologies/yungifez-skuul), [Yungifez Skuul](https://junglewise.ai/threats/technologies/skuul). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Yungifez](https://junglewise.ai/threats/vendors/yungifez).

## Quick answers

**Is CVE-2025-13785 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13785 being exploited in the wild.

**How severe is CVE-2025-13785?** Medium severity, with a CVSS score of 4.3, published 30 November 2025.

**Which products and versions are affected?** yungifez/skuul (Packagist) ECOSYSTEM:introduced=0,last_affected=2.6.4; Yungifez Skuul School Management System up to 2.6.5.

**Is there a fix for CVE-2025-13785?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-13785 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-13785?** Check whether you run yungifez/skuul (Packagist), Yungifez Skuul or Yungifez Skuul School Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Skuul versions up to 2.6.5 contain an information disclosure vulnerability in the image upload handler (/user/profile component). The vulnerability exists because the application accepts and serves uploaded images without removing EXIF metadata, which may contain GPS coordinates, device identifiers, creation timestamps, and other personal data embedded by the camera or device. The attack is remotely accessible to any authenticated user who can access or download profile images; no special privileges are required. An attacker can extract this metadata using standard EXIF viewers to obtain sensitive location and device information about image uploaders. The vendor has not yet released a patch; mitigation requires server-side EXIF stripping during image upload.

## Affected products

- yungifez Skuul School Management System up to 2.6.5

## Identifiers

- CVE-2025-13785
- GHSA-xmh7-35v2-fp6h

## Timeline

- 2025-11-04: disclosed: Public disclosure via GitHub Gist by thezeekhan
- 2025-11-30: advisory: CVE-2025-13785 published on NVD

## References

- [https://gist.github.com/thezeekhan/02f5255506080849fc732eea07008634](https://gist.github.com/thezeekhan/02f5255506080849fc732eea07008634)
- [https://vuldb.com/?ctiid.333789](https://vuldb.com/?ctiid.333789)

## Related threats

- [yungifez Skuul missing authorization in graduation reset](https://junglewise.ai/threats/cve-2026-124502-a-security-vulnerability-has-been-detected-in-yungifez-skuul)
- [Skuul School Management System broken object-level authorization in result checker](https://junglewise.ai/threats/cve-2026-117028-skuul-school-management-system-through-version-2-6-5-is)
- [yungifez Skuul School Management System stored XSS in SVG handler](https://junglewise.ai/threats/cve-2025-13784-yungifez-skuul-school-management-system-stored-xss-in-svg-handler)
- [Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice](https://junglewise.ai/threats/cve-2025-12918-skuul-school-management-system-has-an-insecure-direct-object)