CVE-2025-31959 is a vulnerability in HCL BigFix Service Management (SM) version 23 where the application fails to strip EXIF metadata from uploaded images. EXIF metadata can contain sensitive information such as geolocation data, which if exposed, may compromise user privacy. The vulnerability is categorized as CWE-1230 (Exposure of Sensitive Information Through Metadata). The CVSS v3.1 base score is 3.5 (low severity), with an attack vector of network, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality only. No official remediation or patch has been documented by the vendor as of the publication date.

The vulnerability allows sensitive metadata, including potentially location information, to be exposed when images are uploaded and shared via the affected application. This can lead to confidentiality and privacy risks for users. There is no indication of impact on integrity or availability. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid uploading images containing sensitive metadata or manually remove EXIF metadata before upload. Monitor vendor communications for updates on patches or official mitigations.