Sensitive Data Exposure in Uploaded Images Summary Skuul version 2.6.5 fails to sanitize or remove embedded EXIF metadata from uploaded images. This allows other users or administrators to extract sensitive information such as GPS location, device model, timestamps, and other personal data about the uploader. Vulnerability Details When an image is uploaded via the profile photo, Skuul retains the original EXIF metadata, which may include: GPS coordinates (latitude, longitude) Device make, model, and serial information Photo creation and modification timestamps Camera owner or software details User-defined tags or comments This metadata is accessible via the image URL, causing sensitive data exposure and potential privacy violations. Steps to Reproduce 1. Login to Skuul as a user. 2. Navigate to the profile page. 3. Upload an image with metadata. 4. Save the image. 5. View EXIF data using online tools. 6. Observe the sensitive EXIF data. Impact User location disclosure. Personal or device information leakage. Privacy and data protection policy violations. Potential GDPR non-compliance. Recommendation Implement server-side EXIF stripping. Store and serve sanitized image versions. Apply EXIF sanitization across all modules. Periodically review stored files. Affected Version Skuul v2.6.5 Credits Zeeshan Khan