Unrestricted File Upload in Salesforce Tableau Server for Windows and Linux
CVE-2025-52449

8.5HIGH

Key Information:

Vendor

Salesforce

Status
Tableau Server
Vendor
CVE Published:
25 July 2025

What is CVE-2025-52449?

A vulnerability in Salesforce Tableau Server allows for the unrestricted upload of potentially dangerous files. This weakness can lead to alternative execution paths due to deceptive filenames, enabling remote code execution. It affects versions of Tableau Server prior to 2025.1.3, 2024.2.12, and 2023.3.19 on both Windows and Linux platforms.

Affected Version(s)

Tableau Server Windows 0 < 2025.1.3

Tableau Server Windows 0 < 2024.2.12

Tableau Server Windows 0 < 2023.3.19

References

https://help.salesforce.com/s/articleView?id=005105043&ty...

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-52449 : Unrestricted File Upload in Salesforce Tableau Server for Windows and Linux