CVE-2026-27892: FacturaScripts sensitive information disclosure in Library module

Executive brief

FacturaScripts, an open-source enterprise resource planning (ERP) application, contains a privacy vulnerability in its Library module. When users upload images, the system fails to remove hidden metadata, such as GPS location coordinates and device information. This allows any other user with access to the library to download these images and identify the precise physical location where the photo was taken, potentially exposing employees' home addresses or sensitive business sites.

Technical details

A sensitive information disclosure vulnerability exists in FacturaScripts due to improper sanitization of uploaded image files. The Library module stores uploaded images byte-for-byte without stripping EXIF, XMP, or IPTC metadata. An authenticated attacker can download these images and use standard tools to extract sensitive data, including GPS coordinates, device serial numbers, and original timestamps. This is a design-level omission in the file upload handler. As of the advisory date, no patched version is specified, but remediation involves implementing server-side metadata stripping using libraries like GD or Imagick.

Affected products

• NeoRazorX FacturaScripts <= 2025.81

Timeline

• 2026-05-07: advisory: GHSA-q7f2-rv22-2xgr published

References

• https://api.github.com/users/sudo0xksh
• https://github.com/sudo0xksh
• https://api.github.com/users/sudo0xksh/gists%7B/gist_id%7D
• https://api.github.com/users/sudo0xksh/repos
• https://avatars.githubusercontent.com/u/197823718?v=4
• https://api.github.com/users/sudo0xksh/events%7B/privacy%7D