CVE-2026-27892

Summary

FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

Severity

medium

EPSS

0.2% (p13)

Also known as

GHSA-q7f2-rv22-2xgr

Published

2026-05-07

References

• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-q7f2-rv22-2xgr
• https://nvd.nist.gov/vuln/detail/CVE-2026-27892
• https://github.com/NeoRazorX/facturascripts/commit/b0725147a61a9a377b7180589af33ff52b4751e2

Related advisories

• CVE-2026-27891 — high · Packagist/facturascripts/facturascripts
• CVE-2026-25514 — high · Packagist/facturascripts/facturascripts
• CVE-2026-25513 — high · Packagist/facturascripts/facturascripts
• CVE-2026-23997 — high · Packagist/facturascripts/facturascripts
• CVE-2025-69210 — high · Packagist/facturascripts/facturascripts
• CVE-2026-42879 — medium · Packagist/facturascripts/facturascripts
• CVE-2026-42878 — medium · Packagist/facturascripts/facturascripts
• CVE-2026-42877 — medium · Packagist/facturascripts/facturascripts

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity