CVE-2025-26497: 
Tableau Server vulnerability analysis and mitigation

CVE-2025-26497 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in Salesforce Tableau Server's Flow Editor module, affecting both Windows and Linux platforms. It allows unauthenticated remote attackers to perform Absolute Path Traversal by uploading files with dangerous types. Affected versions include Tableau Server before 2025.1.3, before 2024.2.12, and before 2023.3.19. The vulnerability was published on August 22, 2025, with a CVSS v3.1 base score of 7.3 (High) (Salesforce Advisory, Red Hat CVE).

The root cause is insufficient validation of uploaded file types within the Flow Editor module of Tableau Server (CWE-434), which fails to restrict uploads to safe file types or safe destination paths. By uploading a file with a dangerous type, an attacker can leverage Absolute Path Traversal to write files to arbitrary locations on the server's filesystem. The attack vector is network-based, requires no authentication (privileges required: none) and no user interaction, making it trivially exploitable against exposed instances on both Windows and Linux. No public proof-of-concept code has been identified at this time (Salesforce Advisory, Red Hat CVE).

Successful exploitation could allow an unauthenticated attacker to upload malicious files to arbitrary paths on the Tableau Server filesystem, potentially leading to unauthorized file access, data exposure, or manipulation of server-side files. In a worst-case scenario, an attacker could overwrite critical configuration or executable files, potentially enabling further compromise or lateral movement within the environment. The vulnerability affects confidentiality, integrity, and availability at a low level individually, but the combination of unrestricted upload and path traversal creates meaningful risk for enterprise deployments (Salesforce Advisory, GBHackers).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time (Red Hat CVE). The EPSS score is approximately 0.018%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability is detectable by Qualys (detection ID 384647) and Tenable (Tenable).

1. Reconnaissance: Identify internet-facing Tableau Server instances running vulnerable versions (before 2025.1.3, 2024.2.12, or 2023.3.19) using tools like Shodan or Censys, targeting exposed Flow Editor endpoints.
2. Access Flow Editor endpoint: Navigate to the Tableau Server Flow Editor module, which is accessible without authentication due to the lack of privilege requirements.
3. Craft malicious upload request: Prepare a file upload request containing a file with a dangerous type (e.g., a web shell, script, or executable) and specify an absolute path as the upload destination to exploit the path traversal weakness.
4. Upload file to arbitrary path: Submit the crafted request to the Flow Editor's file upload endpoint; the server fails to validate the file type or restrict the destination path, allowing the file to be written to an attacker-controlled location on the filesystem.
5. Achieve objective: Depending on the file written and its location, the attacker may achieve remote code execution (e.g., by placing a web shell in a web-accessible directory), data exfiltration, or persistent access (Salesforce Advisory, GBHackers).

• Network: Unusual or unexpected HTTP POST requests to Tableau Server Flow Editor upload endpoints from external or untrusted IP addresses; large or anomalous file upload activity in web server access logs.
• File System: Presence of unexpected files (scripts, executables, web shells) in Tableau Server directories or other non-standard filesystem paths; files with extensions such as .php, .jsp, .aspx, .sh, .bat, or .exe in upload-related directories.
• Logs: Tableau Server application logs showing file upload operations with absolute path parameters or paths outside expected upload directories; error logs indicating path traversal attempts.
• Process: Unexpected processes spawned by the Tableau Server service account, particularly shells or scripting interpreters (e.g., cmd.exe, powershell.exe, bash, python) (GBHackers, Salesforce Advisory).

Salesforce has released patched versions of Tableau Server: 2025.1.3, 2024.2.12, and 2023.3.19. Organizations should upgrade to one of these versions immediately. As interim mitigations, restrict network access to Tableau Server (particularly the Flow Editor module) to trusted users and networks, implement strict file upload validation at the network perimeter (e.g., WAF rules), and apply least-privilege principles to the Tableau Server service account. Monitor and audit file upload activities for anomalous behavior (Salesforce Advisory, Red Hat CVE).

Security media outlets including GBHackers, CyberSecurityNews, SecurityOnline, and CyberPress covered the vulnerability shortly after disclosure, highlighting the risk of malicious file uploads and potential remote code execution in enterprise Tableau deployments (GBHackers, SecurityOnline, CyberSecurityNews). Black Kite included CVE-2025-26497 in its third-party risk management (TPRM) Focus Friday series, recommending organizations assess vendor exposure (Black Kite). Community discussion on Mastodon/infosec.exchange noted the vulnerability shortly after publication.