Overview
CVE-2025-52449 is a serious vulnerability that affects Salesforce Tableau Server on both Windows and Linux platforms, specifically within the Extensible Protocol Service modules. This vulnerability allows for unrestricted upload of files with dangerous types, leading to alternative execution due to deceptive filenames. The risk associated with this vulnerability is high as it can lead to a potential system compromise or data leakage, a nightmare scenario for any organization relying on the integrity and confidentiality of its data.
Vulnerability Summary
CVE ID: CVE-2025-52449
Severity: High (8.5 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Compromise of system integrity and potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Tableau Server on Windows | before 2025.1.3
Tableau Server on Linux | before 2025.1.3
Tableau Server on all platforms | before 2024.2.12, before 2023.3.19
How the Exploit Works
The exploit takes advantage of a vulnerability in the Extensible Protocol Service modules of Salesforce’s Tableau Server. By allowing unrestricted file uploads of dangerous types, an attacker can upload a malicious file with a deceptive filename, which could lead to remote code execution (RCE) if the file is run.
The deceptive filename could trick a user into thinking they are opening a benign file, when in fact they are executing malicious code. This could lead to a compromise of the entire system, potentially providing the attacker with full control over the affected server. Furthermore, the exploit could also lead to data leakage, potentially exposing sensitive information.
Conceptual Example Code
POST /extensible_protocol/upload HTTP/1.1
Host: target.example.com
Content-Type: application/octet-stream
Content-Disposition: form-data; name="file"; filename="benign_file.pdf.exe"
{ "malicious_payload": "..." }In this conceptual example, a malicious payload is being uploaded to the server under the guise of a benign PDF file. However, the true file type is an executable, which could be run on the server once uploaded, leading to remote code execution.