CVE-2025-26498: 
Tableau Server vulnerability analysis and mitigation

CVE-2025-26498 is an Unrestricted File Upload vulnerability (CWE-434) in Salesforce Tableau Server affecting both Windows and Linux platforms, specifically within the establish-connection-no-undo modules. The flaw enables Absolute Path Traversal, allowing unauthenticated network-based attackers to upload files with dangerous types to arbitrary server paths. Affected versions include Tableau Server before 2025.1.3, before 2024.2.12, and before 2023.3.19. It was published on August 22, 2025, with a CVSS v3.1 base score of 7.3 (High) (Salesforce Advisory, Red Hat CVE).

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and manifests in the establish-connection-no-undo modules of Tableau Server on both Windows and Linux. By combining unrestricted file upload with absolute path traversal, an unauthenticated remote attacker can write arbitrary files to any location accessible by the Tableau Server process, bypassing directory restrictions. No authentication, user interaction, or elevated privileges are required for exploitation, and attack complexity is low (Salesforce Advisory, Red Hat CVE).

Successful exploitation allows attackers to upload malicious files to arbitrary paths on the server, potentially leading to unauthorized file access, server resource manipulation, and system compromise. The combination of path traversal and unrestricted file upload could enable an attacker to plant web shells or overwrite critical configuration files, facilitating further lateral movement within the enterprise environment. The vulnerability carries low confidentiality, integrity, and availability impacts per CVSS scoring, though chained with other weaknesses, the real-world risk could be significantly higher (Salesforce Advisory, GBHackers).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.018%, indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has detection coverage for this CVE (detection ID 384647) (Feedly).

1. Reconnaissance: Identify internet-facing Tableau Server instances running versions before 2025.1.3, 2024.2.12, or 2023.3.19 using tools like Shodan or Censys, targeting exposed Tableau Server endpoints.
2. Identify vulnerable module: Locate the establish-connection-no-undo module endpoint on the target Tableau Server, which handles file upload operations without proper type or path validation.
3. Craft malicious upload request: Construct an HTTP request that includes a file with a dangerous type (e.g., a web shell script) and an absolute path traversal payload in the filename or path parameter (e.g., ../../../../var/www/html/shell.php or equivalent Windows path).
4. Upload file: Submit the crafted request to the vulnerable endpoint without authentication, causing the server to write the malicious file to the attacker-specified absolute path.
5. Achieve objective: Access the uploaded file via the web server (if a web shell was placed in a web-accessible directory) to execute arbitrary commands, or leverage the planted file for persistence, privilege escalation, or further lateral movement (Salesforce Advisory, GBHackers).

• Network: Unexpected HTTP POST requests to Tableau Server endpoints associated with establish-connection-no-undo modules, especially from unauthenticated or unknown source IPs; unusual outbound connections from the Tableau Server host following file upload activity.
• File System: Presence of unexpected files (e.g., scripts, executables, web shells) in non-standard directories outside the Tableau data directory; files with suspicious extensions (.php, .jsp, .aspx, .sh, .ps1) in web-accessible or system directories.
• Logs: Tableau Server access logs showing POST requests with path traversal sequences (e.g., ../, ..\, or absolute paths) in upload parameters; error logs indicating file write operations to unexpected locations.
• Process: Unusual child processes spawned by the Tableau Server process (e.g., cmd.exe, powershell.exe, /bin/bash, curl, wget) that are not part of normal Tableau operations.

Salesforce has released patched versions of Tableau Server: 2025.1.3, 2024.2.12, and 2023.3.19. Organizations should upgrade to the appropriate patched version immediately. As interim mitigations, restrict network access to Tableau Server using firewalls or network segmentation to limit exposure, implement strict file upload validation at the network perimeter (e.g., WAF rules), and monitor all file upload activity and server logs for anomalous behavior (Salesforce Advisory).

The vulnerability received coverage from multiple cybersecurity news outlets including GBHackers, CyberSecurityNews, and SecurityOnline, which highlighted the risk of malicious file uploads and potential remote code execution in enterprise Tableau deployments (GBHackers, SecurityOnline). Black Kite included CVE-2025-26498 in its Focus Friday TPRM analysis, recommending third-party risk management actions for organizations relying on Tableau Server (Black Kite). Community discussion on Infosec.exchange noted the vulnerability shortly after disclosure, reflecting moderate security community interest.