The issue arises because the Library module stores and serves uploaded images without removing EXIF, XMP, or IPTC metadata. Any authenticated user who downloads an image can extract stored GPS coordinates, device information, timestamps, comments, and thumbnails, resulting in the disclosure of personal location data and other sensitive information. This leakage can reveal an employee’s home address or other private details to all users with download access, creating a significant privacy violation.

NeoRazorX FacturaScripts, versions released before 2026, uses the Library module that allows unrestricted uploads and provides authenticated download access without sanitizing metadata. These affected releases are any builds in the FacturaScripts codebase containing that module prior to the 2026 release that implements server‑side metadata stripping.

The CVSS score of 6.5 indicates moderate to high severity. EPSS is not available, so the exact exploitation probability is unknown but likely low to moderate; the vulnerability is also not listed in CISA KEV. The attack vector requires authenticated access; an attacker must be a legitimate user with permissions to download library images, but no additional privileges are needed. Once authenticated, the attacker can retrieve any image’s embedded metadata, leading to privacy exposure but no direct system compromise or denial of service.