GitHub Security Advisory: GHSA-q7f2-rv22-2xgr
Package: facturascripts/facturascripts (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: <= 2025.81
Patched in: unpatched

Summary: FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

Details:
## Summary

**Fectura Scripts** is an open-source ERP application, a **sensitive information disclosure vulnerability** was identified in the **Library** module's image upload and download pipeline. The application fails to strip EXIF and other embedded metadata from user-uploaded image files before storing them and serving them for download. As a result, any authenticated user who downloads an image from the Library can extract the original uploader's **GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII)** preserved in the image metadata.

This vulnerability carries significant real-world impact: **an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access.**

---

## Affected Functionality Overview

Fectura Scripts exposes image upload capabilities across several modules (e.g., email composition, profile settings, etc.). During testing, the **Library section** was identified as the only module that provides:

- **Full image upload** (unrestricted image types observed)
- **Persistent storage** of uploaded files
- **Direct download** capability for any authenticated user with access
- **No server-side metadata sanitization** at any point in the pipeline (upload, storage, or delivery)

Other modules (e.g., email attachments) were also tested but either did not render images or had limited upload/download exposure.

---

## Technical Background

### What Is EXIF/Image Metadata?

Most modern image formats (JPEG, TIFF, PNG with ancillary chunks, HEIC, WebP with XMP) embed metadata automatically at creation time. This metadata can include:

| Metadata Category | Example Fields | Privacy Risk |
|---|---|---|
| **GPS / Geolocation** | GPSLatitude, GPSLongitude, GPSAltitude, GPSTimestamp | **Critical** — reveals exact physical location |
| **Device Information** | Make, Model, Software, LensModel | Medium — device fingerprinting |
| **Timestamps** | DateTimeOriginal, CreateDate, ModifyDate | Medium — behavioral profiling |
| **User Comments** | UserComment, ImageDescription, XPComment, XPAuthor | **High** — may contain names, notes, PII |
| **Thumbnails** | ThumbnailImage (embedded JPEG preview) | **High** — may preserve original uncropped image |
| **Serial Numbers** | BodySerialNumber, LensSerialNumber, InternalSerialNumber | Medium — unique device tracking |
| **Network/Software** | HostComputer, Software, ProcessingSoftware | Low–Medium — infrastructure disclosure |
| **XMP / IPTC** | Creator, Rights, Description, Keywords | Medium — organizational/authorship leakage |

### Why This Matters in an ERP Context

ERP platforms are used by businesses with multiple employees, contractors, clients, and sometimes external partners accessing shared resources. The **Library** module is inherently a collaborative, shared-access feature. Any image uploaded by one party is downloadable b