The vulnerability arises because HCL BigFix Service Management does not remove EXIF metadata when users upload images. The absence of sanitization means that uploaded files may carry embedded data such as GPS coordinates, camera make or model, and timestamps. This data can expose confidential or private information about employees, clients, or service locations. The weakness corresponds to CWE-1230, which relates to insufficient sanitization resulting in information disclosure.

The affected product is HCL BigFix Service Management from HCL Software. No specific version information is supplied by the CNA, so all versions currently in use may be vulnerable until an update is available. Administrators should verify whether the application serves uploaded image files and whether any filters apply to EXIF data.

The CVSS score of 3.5 indicates a low severity. No EPSS score is provided, suggesting no known exploitation data. The vulnerability is not listed in the CISA KEV catalog. Exploitation would involve uploading a crafted image containing location data, which the system then stores or displays to users, potentially disclosing sensitive geographic information. Attack likely requires relative user or service permissions to upload content but no remote code execution or system compromise is implied.