CVE-2025-52450: 
Tableau Server vulnerability analysis and mitigation

CVE-2025-52450 is a path traversal vulnerability (Absolute Path Traversal) in Salesforce Tableau Server affecting both Windows and Linux platforms, specifically within the abdoc API's create-data-source-from-file-upload modules. It was published on August 22, 2025, and affects Tableau Server versions before 2025.1.3, before 2024.2.12, and before 2023.3.19. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium/High), requiring only low-privilege network access with no user interaction (Salesforce Advisory, Red Hat CVE).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal), specifically an Absolute Path Traversal variant. The vulnerability exists in the abdoc API module responsible for handling file uploads when creating data sources, where user-supplied file path input is not properly sanitized or restricted to an intended directory. An authenticated attacker with low privileges can craft a malicious file upload request containing an absolute path that escapes the intended directory boundary, enabling access to arbitrary files on the server filesystem. Attack patterns associated with this vulnerability include path manipulation techniques such as using slashes, URL encoding, and alternate encodings to bypass validation logic (CAPEC-126, CAPEC-64, CAPEC-76) (Salesforce Advisory, Red Hat CVE).

Successful exploitation allows a low-privileged, remote attacker to read arbitrary files outside the intended directory on the Tableau Server host, resulting in a high confidentiality impact with no integrity or availability impact. Sensitive files such as configuration files, credentials, private keys, or other server-side data could be exposed, potentially enabling further lateral movement or privilege escalation within the environment. The attack requires no user interaction and can be performed over the network with low complexity, making it accessible to a broad range of threat actors (Salesforce Advisory, GBHackers).

As of the time of reporting, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation for CVE-2025-52450. The EPSS score is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection support is available via Qualys (detection ID 384647) and Tenable (Feedly, Tenable).

1. Reconnaissance: Identify internet-facing or internally accessible Tableau Server instances running versions prior to 2025.1.3, 2024.2.12, or 2023.3.19 using network scanning tools or Shodan/Censys queries targeting Tableau Server banners.
2. Authentication: Obtain or use any low-privilege Tableau Server account credentials, as the vulnerability requires only low-privilege access.
3. Identify vulnerable endpoint: Target the abdoc API endpoint responsible for the create-data-source-from-file-upload functionality.
4. Craft malicious request: Construct a file upload API request where the file path parameter contains an absolute path traversal sequence (e.g., specifying an absolute path such as /etc/passwd on Linux or C:\Windows\System32\drivers\etc\hosts on Windows) instead of a relative path within the intended upload directory.
5. Exfiltrate sensitive files: Submit the crafted request and retrieve the contents of the targeted file from the server response, potentially exposing credentials, configuration files, or other sensitive data (Salesforce Advisory, Red Hat CVE).

• Network: Unusual or repeated API requests to the Tableau Server abdoc API endpoint for create-data-source-from-file-upload from unexpected source IPs or at unusual times; requests containing absolute path strings (e.g., /etc/, C:\Windows\) in file upload parameters.
• Logs: Tableau Server access logs showing API calls to the file upload endpoint with path parameters containing .., /etc/, C:\, or other absolute path indicators; error log entries related to file access outside the expected upload directory.
• File System: Evidence of file read operations on sensitive system files (e.g., /etc/passwd, /etc/shadow, Tableau configuration files) by the Tableau Server process at unexpected times.
• Process: Tableau Server process accessing files outside its normal working directories as observed via OS-level auditing (e.g., Linux auditd or Windows Event Logs for file access events).

Salesforce has released patched versions of Tableau Server to address this vulnerability: update to 2025.1.3, 2024.2.12, or 2023.3.19 as appropriate for your release line. Upgrading to a patched version is the primary recommended remediation. As interim mitigations, organizations should implement strict input validation for file path operations, restrict and monitor low-privilege user access to the affected API, apply network segmentation to limit Tableau Server exposure, and enforce least-privilege principles on server configurations (Salesforce Advisory).

The vulnerability received coverage from multiple cybersecurity news outlets including GBHackers, CyberSecurityNews, SecurityOnline, and CyberPress, often in the context of a broader set of Tableau Server flaws disclosed simultaneously. Black Kite highlighted the vulnerability in its Focus Friday TPRM series, recommending third-party risk management actions for organizations using Tableau Server. Community discussion was noted on Mastodon/infosec.exchange shortly after disclosure. Coverage generally emphasized the risk to enterprise environments given Tableau Server's widespread use for business intelligence (GBHackers, Black Kite, SecurityOnline).