Image attachments retain EXIF metadata (including GPS location) — served back verbatim to any user with ticket access #97

New Issue

2026-09-01T00:13:38-04:00

jared commented

2026-09-01 00:13:38 -04:00

Severity: Medium (privacy)

api/upload_attachment.php does a raw move_uploaded_file() with zero image processing anywhere in the codebase (confirmed: no GD/Imagick calls exist in the app at all). A photo attached from a phone (e.g. documenting a hardware issue on-site) retains its embedded EXIF data, including GPS coordinates if the phone's camera app embeds them, and download_attachment.php streams the file byte-for-byte back to any user with ticket visibility.

Impact: For an infrastructure company, this can leak a data center or office's precise physical location through a routine ticket photo — especially concerning for internal/confidential tickets whose whole point is restricting who sees exactly this kind of sensitive detail, when the leak happens via file bytes rather than the visibility-checked ticket text.

Fix: Strip EXIF (or at minimum GPS tags) from image uploads before storing — e.g. read with exif_read_data()/GD, strip metadata, and re-encode before writing to disk.

**Severity:** Medium (privacy) `api/upload_attachment.php` does a raw `move_uploaded_file()` with zero image processing anywhere in the codebase (confirmed: no GD/Imagick calls exist in the app at all). A photo attached from a phone (e.g. documenting a hardware issue on-site) retains its embedded EXIF data, including GPS coordinates if the phone's camera app embeds them, and `download_attachment.php` streams the file byte-for-byte back to any user with ticket visibility. **Impact:** For an infrastructure company, this can leak a data center or office's precise physical location through a routine ticket photo — especially concerning for `internal`/`confidential` tickets whose whole point is restricting who sees exactly this kind of sensitive detail, when the leak happens via file bytes rather than the visibility-checked ticket text. **Fix:** Strip EXIF (or at minimum GPS tags) from image uploads before storing — e.g. read with `exif_read_data()`/GD, strip metadata, and re-encode before writing to disk.

jared added the priority/medium security labels 2026-09-08 10:15:50 -04:00

jared referenced this issue from a commit

2026-09-08 14:35:21 -04:00

Strip EXIF/GPS metadata from image uploads (#97)

jared referenced this issue from a commit

2026-09-08 15:39:42 -04:00

Merge development into main: 15-issue triage + fix batch

Sign in to join this conversation.