CVE-2026-12735 · Vendor
NO FIX YET
IBM Controller Disclosure Management 1.0.0.0 does not properly strip sensitive information from images before storing them. An attacker who can reach the uploaded files can read EXIF metadata that the product should have removed.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running IBM Controller Disclosure Management 1.0.0.0 that accept image uploads. Whether stored uploads are reachable by outsiders depends on the deployment, and the sources do not say more.
Not affected if unknown
Who cares controller-disclosure-management, ibm
Unknown from the sources.
No fix yet, per the sources.
IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper removal of sensitive information before storage.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.