{"id":"CVE-2026-12735","kind":"vulnerability","aliases":["CVE-2026-12735"],"related":[],"title":"IBM Controller Disclosure Management leaks EXIF metadata from uploaded images","description":"IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper removal of sensitive information before storage.","summary":"IBM Controller Disclosure Management 1.0.0.0 does not properly strip sensitive information from images before storing them. An attacker who can reach the uploaded files can read EXIF metadata that the product should have removed.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["controller-disclosure-management","ibm","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-08T18:17:01+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","triaged_at":"2026-11-08T18:23:05+00:00","updated_at":"2026-11-08T18:23:05+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T18:23:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM Controller Disclosure Management leaks EXIF metadata from uploaded images","impact":"low","summary":"IBM Controller Disclosure Management 1.0.0.0 does not properly strip sensitive information from images before storing them. An attacker who can reach the uploaded files can read EXIF metadata that the product should have removed.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","controller-disclosure-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Sensitive EXIF metadata from uploaded images is readable by an attacker.","analyst_note":"Check IBM's security bulletin for CVE-2026-12735 for the fixed version and whether uploads are exposed; the NVD entry gives no product range.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM Controller Disclosure Management 1.0.0.0 that accept image uploads. Whether stored uploads are reachable by outsiders depends on the deployment, and the sources do not say more.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":4532,"output_tokens":460,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-12735':13A,16A '-2026':12A,15A '1.0.0.0':27B,61C 'allow':63C 'attack':40B,65C 'control':2A,18B,24B,58C 'controller-disclosure-manag':17B 'could':62C 'cve':11A,14A 'disclosur':3A,19B,25B,59C 'due':74C 'exif':6A,49B,69C 'file':46B 'ibm':1A,21B,23B,57C 'imag':10A,35B,73C 'improp':76C 'inform':33B,80C 'leak':5A 'manag':4A,20B,26B,60C 'metadata':7A,50B,70C 'obtain':67C 'product':53B 'proper':30B 'reach':43B 'read':48B 'remov':56B,77C 'sensit':32B,68C,79C 'storag':82C 'store':37B 'strip':31B 'upload':9A,45B,72C 'vendor':22B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Controller Disclosure Management 1.0.0.0 that accept image uploads. Whether stored uploads are reachable by outsiders depends on the deployment, and the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["controllerdisclosuremanagement","ibm","medium","vendor"],"campaign_type":null,"search_a":"'-12735':13A,16A '-2026':12A,15A 'control':2A 'cve':11A,14A 'disclosur':3A 'exif':6A 'ibm':1A 'imag':10A 'leak':5A 'manag':4A 'metadata':7A 'upload':9A","search_b":"'1.0.0.0':27B 'attack':40B 'control':18B,24B 'controller-disclosure-manag':17B 'disclosur':19B,25B 'exif':49B 'file':46B 'ibm':21B,23B 'imag':35B 'inform':33B 'manag':20B,26B 'metadata':50B 'product':53B 'proper':30B 'reach':43B 'read':48B 'remov':56B 'sensit':32B 'store':37B 'strip':31B 'upload':45B 'vendor':22B","search_c":"'1.0.0.0':61C 'allow':63C 'attack':65C 'control':58C 'could':62C 'disclosur':59C 'due':74C 'exif':69C 'ibm':57C 'imag':73C 'improp':76C 'inform':80C 'manag':60C 'metadata':70C 'obtain':67C 'remov':77C 'sensit':68C,79C 'storag':82C 'upload':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12735","severity":null,"published_at":"2026-11-08T18:17:01+00:00","modified_at":"2026-11-08T18:17:01+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","fetched_at":"2026-11-08T18:22:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}