Overview
The vulnerability, identified as CVE-2025-52451, is a serious security lapse found in Salesforce’s widely used Tableau Server software. This vulnerability, categorized as an Improper Input Validation issue, allows cyber attackers to exploit Absolute Path Traversal in the tabdoc API’s create-data-source-from-file-upload modules. This vulnerability affects a broad range of organizations and industries that depend on Tableau Server for data visualization and business intelligence. If successfully exploited, this vulnerability could lead to system compromise or data leakage, making it a grave threat to data integrity and security.
Vulnerability Summary
CVE ID: CVE-2025-52451
Severity: High (CVSS Score: 8.5)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise and potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Tableau Server on Windows | Versions before 2025.1.3
Tableau Server on Linux | Versions before 2024.2.12, before 2023.3.19
How the Exploit Works
The exploit takes advantage of an Improper Input Validation vulnerability in the create-data-source-from-file-upload module of the tabdoc API, present in Salesforce’s Tableau Server software. By sending maliciously crafted data to the module, an attacker can manipulate the data validation process and trigger an Absolute Path Traversal vulnerability. This allows the attacker to access, modify, or delete sensitive data outside of the designated boundaries, potentially leading to system compromise or data leakage.
Conceptual Example Code
In a hypothetical scenario, the exploit might be used as follows:
POST /tabdocapi/create-data-source-from-file-upload HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "file_path": "/../../../../etc/passwd" }In this conceptual example, the attacker sends a POST request to the vulnerable endpoint with a malicious `file_path`. The path includes directory traversal characters (`..`), manipulating the software into accessing files outside of the intended directory. In this case, the attacker attempts to access the `/etc/passwd` file, which stores user account information in Unix-based systems, potentially leading to unauthorized access and data leakage.
