Images uploaded as tracker attachment or files in the FRS or Document service are not changed in any way.
It would be nice to strip all the metadata of the images when not needed (metadata are used by the Mediawiki service but outside of that we have no need for them) to prevent users to inadvertently leak locations or other PI.
Acknowledgement: this issue has been reported by Shubham Shete via the Tuleap coordinated disclosure process.