CVE-2025-52449

HIGH

Tableau Server < 2025.1.3, < 2024.2.12, < 2023.3.19 - Remote Code Execution via Deceptive Filename Upload

Title source: llm
STIX 2.1

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.

References (1)

Core 1

Scores

CVSS v3 8.5
EPSS 0.0023
EPSS Percentile 13.8%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
tableau/tableau_server < 2023.3.19
Published Jul 25, 2025
Tracked Since Feb 18, 2026