---
id: "CVE-2026-12735"
page: "https://infrastack.ai/live/CVE-2026-12735"
kind: "vulnerability"
aliases: ["CVE-2026-12735"]
title: "IBM Controller Disclosure Management leaks EXIF metadata from uploaded images"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["controller-disclosure-management", "ibm", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-11-08T18:17:01+00:00"
first_seen_at: "2026-11-08T18:22:21+00:00"
updated_at: "2026-11-08T18:23:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12735", "first_seen_at": "2026-11-08T18:22:21+00:00"}]
exploit_sources: []
---

# IBM Controller Disclosure Management leaks EXIF metadata from uploaded images

Link for people: https://infrastack.ai/live/CVE-2026-12735 (this .md is for agents)

IBM Controller Disclosure Management 1.0.0.0 does not properly strip sensitive information from images before storing them. An attacker who can reach the uploaded files can read EXIF metadata that the product should have removed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-08T18:22:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12735

## From the sources

IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper removal of sensitive information before storage.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_