CVE-2026-27892 Details
Description
FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-byte, without stripping EXIF/XMP/IPTC metadata. Any authenticated user who downloaded an image could extract the uploader's embedded metadata, which included GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII) preserved in the image metadata. Of all FacturaScripts' image upload features, only the Library module combined unrestricted uploads, persistent storage, authenticated download access, and a total lack of server-side metadata sanitization. This vulnerability carries significant real-world impact: an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access. This issue has been fixed in version 2026.
A sensitive information disclosure vulnerability has been identified in the Library module of FacturaScripts, an open-source accounting and invoicing software. In versions prior to 2026, the Library module stored uploaded images without removing embedded EXIF, XMP, and IPTC metadata. This oversight allowed any authenticated user who downloaded an image to access the uploader's personal information, including GPS coordinates, device details, timestamps, comments, thumbnail previews, and other personally identifiable information (PII). The vulnerability is particularly concerning as it could lead to unintentional disclosure of sensitive information, such as an employee's home address, to other users with Library download access.
Users are advised to update to FacturaScripts version 2026, where this vulnerability has been addressed. For those using earlier versions, implement server-side metadata stripping for all image uploads in the Library module before storage, and retroactively clean up existing images.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 18, 2026CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-q7f2-rv22-2xgr | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/NeoRazorX/facturascripts/commit/b0725147a61a9a377b7180589af33ff52b4751e2 | [email protected] | Source CodeVendor |
| https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-q7f2-rv22-2xgr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-212 | Improper Removal of Sensitive Information Before Storage or Transfer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FacturaScripts | <= v2025.81 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | New CVE Received | [email protected] |