CVE-2025-52449

HIGH

Tableau Server < 2023.3.19 - Unrestricted File Upload

Title source: rule
STIX 2.1

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.

References (1)

Core 1

Scores

CVSS v3 8.5
EPSS 0.0003
EPSS Percentile 9.3%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
tableau/tableau_server < 2023.3.19
Published Jul 25, 2025
Tracked Since Feb 18, 2026