https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:42:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-319404 EUVD-2026-319404 https://cve.radiocsirt.org/vuln/euvd-2026-319404 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27892 <p>FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-byte, without stripping EXIF/XMP/IPTC metadata. Any authenticated user who downloaded an image could extract the uploader&#39;s embedded metadata, which included GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII) preserved in the image metadata. Of all FacturaScripts&#39; image upload features, only the Library module combined unrestricted uploads, persistent storage, authenticated download access, and a total lack of server-side metadata sanitization. This vulnerability carries significant real-world impact: an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access. This issue has been fixed in version 2026.</p> <p>FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-byte, without stripping EXIF/XMP/IPTC metadata. Any authenticated user who downloaded an image could extract the uploader&#39;s embedded metadata, which included GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII) preserved in the image metadata. Of all FacturaScripts&#39; image upload features, only the Library module combined unrestricted uploads, persistent storage, authenticated download access, and a total lack of server-side metadata sanitization. This vulnerability carries significant real-world impact: an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access. This issue has been fixed in version 2026.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27892 https://cve.radiocsirt.org/vuln/ghsa-q7f2-rv22-2xgr <p><strong>Affected:</strong> Packagist: facturascripts/facturascripts</p> <p>## Summary</p> <p>**Fectura Scripts** is an open-source ERP application, a **sensitive information disclosure vulnerability** was identified in the **Library** module&#39;s image upload and download pipeline. The application fails to strip EXIF and other embedded metadata from user-uploaded image files before storing them and serving them for download. As a result, any authenticated user who downloads an image from the Library can extract the original uploader&#39;s **GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII)** preserved in the image metadata.</p> <p>This vulnerability carries significant real-world impact: **an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access.**</p> <p>---</p> <p>## Affected Functionality Overview</p> <p>Fectura Scripts exposes image upload capabilities across several modules (e.g., email composition, profile settings, etc.). During testing, the **Library section** was identified as the only module that provides:</p> <p>- **Full image upload** (unrestricted image types observed) - **Persistent storage** of uploaded files - **Direct download** capability for any authenticated user with access - **No server-side metadata sanitization** at any point in the pipeline (upload, storage, or delivery)</p> <p>Other modules (e.g., email attachments) were also tested but either did not render images or had limited upload/down…</p> <p><strong>Affected:</strong> Packagist: facturascripts/facturascripts</p> <p>## Summary</p> <p>**Fectura Scripts** is an open-source ERP application, a **sensitive information disclosure vulnerability** was identified in the **Library** module&#39;s image upload and download pipeline. The application fails to strip EXIF and other embedded metadata from user-uploaded image files before storing them and serving them for download. As a result, any authenticated user who downloads an image from the Library can extract the original uploader&#39;s **GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII)** preserved in the image metadata.</p> <p>This vulnerability carries significant real-world impact: **an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access.**</p> <p>---</p> <p>## Affected Functionality Overview</p> <p>Fectura Scripts exposes image upload capabilities across several modules (e.g., email composition, profile settings, etc.). During testing, the **Library section** was identified as the only module that provides:</p> <p>- **Full image upload** (unrestricted image types observed) - **Persistent storage** of uploaded files - **Direct download** capability for any authenticated user with access - **No server-side metadata sanitization** at any point in the pipeline (upload, storage, or delivery)</p> <p>Other modules (e.g., email attachments) were also tested but either did not render images or had limited upload/down…</p> https://cve.radiocsirt.org/vuln/ghsa-q7f2-rv22-2xgr