Improper Removal of Sensitive Information Before Storage or Transfer in FacturaScripts - CVE-2026-27892
Published: November 9, 2026
Vulnerability identifier: #VU163105
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-27892
CWE-ID: CWE-212
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged authenticated attacker with Library download access to obtain sensitive image metadata revealing an uploader's location and personal information.
The vulnerability exists due to missing metadata sanitization in FacturaScripts' Library module when images containing EXIF or other embedded metadata are uploaded and downloaded. A low-privileged authenticated attacker can download another user's uploaded image and extract preserved GPS coordinates and identifying comments.
Affected software
FacturaScripts
How to mitigate CVE-2026-27892
Install security update from vendor's website.
FacturaScripts - update to 2026