CVE-2025-52451: 
Tableau Server vulnerability analysis and mitigation

CVE-2025-52451 is an Improper Input Validation vulnerability in Salesforce Tableau Server on Windows and Linux that enables Absolute Path Traversal attacks via the tabdoc API's create-data-source-from-file-upload modules. It affects Tableau Server versions before 2025.1.3, before 2024.2.12, and before 2023.3.19 across all supported release lines. The vulnerability was published on August 22, 2025, with a CVSS v3.1 base score of 8.5 (High) (Salesforce Advisory, Red Hat CVE).

The root cause is classified as CWE-20 (Improper Input Validation), specifically within the tabdoc API's file upload handling logic (create-data-source-from-file-upload modules). An attacker on an adjacent network can supply a crafted file upload request containing an absolute path, bypassing expected directory restrictions and causing the server to read from or write to arbitrary filesystem locations. Exploitation requires user interaction (e.g., a victim initiating or approving a file upload action) but does not require any prior authentication or privileges. The attack vector is adjacent network (AV:A), meaning the attacker must be on the same network segment or logical network as the target server (Salesforce Advisory, ZeroPath Blog).

Successful exploitation can result in high confidentiality and integrity impact — an attacker could read sensitive files outside the intended upload directory or overwrite arbitrary files on the server filesystem, potentially leading to unauthorized data disclosure or server configuration tampering. The changed scope (S:C) indicates that the impact can extend beyond the Tableau Server process itself to other components or data on the host system. Availability is not directly impacted by this vulnerability (Salesforce Advisory, GBHackers).

As of the time of disclosure, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (ZeroPath Blog). The EPSS score is approximately 0.02%, reflecting a currently low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this vulnerability (detection ID 384647), and Tenable has also issued a plugin for scanning (Salesforce Advisory).

1. Reconnaissance: Identify Tableau Server instances on the adjacent network running vulnerable versions (before 2025.1.3, 2024.2.12, or 2023.3.19) using network scanning tools or Shodan.
2. Access the file upload endpoint: Navigate to or craft an HTTP request targeting the tabdoc API's create-data-source-from-file-upload endpoint on the Tableau Server.
3. Craft a malicious request: Construct a file upload request where the filename or path parameter contains an absolute path (e.g., /etc/passwd on Linux or C:\Windows\System32\config\SAM on Windows) rather than a relative path within the expected upload directory.
4. Trigger user interaction: Induce a legitimate user (e.g., via social engineering or a malicious link) to initiate or approve the file upload action, satisfying the required user interaction precondition.
5. Achieve path traversal: The server processes the absolute path without proper validation, allowing the attacker to read sensitive files from arbitrary locations or overwrite critical server files, potentially leading to credential theft or persistent access (ZeroPath Blog, Salesforce Advisory).

• Network: Unusual HTTP POST requests to Tableau Server's tabdoc API endpoints (e.g., /api/.../create-data-source-from-file-upload) originating from unexpected adjacent network hosts; requests containing absolute path strings (e.g., /etc/, C:\Windows\) in file upload parameters.
• Logs: Tableau Server access logs showing file upload API calls with absolute path values in filename or path fields; error messages or stack traces related to file access outside the designated upload directory in Tableau Server logs.
• File System: Unexpected files appearing in sensitive directories (e.g., /etc/, /var/, C:\Windows\System32\) that correlate with Tableau Server process activity; modification timestamps on system files coinciding with Tableau Server upload events.
• Process: Tableau Server worker processes (tabdoc) accessing file paths outside the configured data directory.

Salesforce has released patched versions of Tableau Server: 2025.1.3, 2024.2.12, and 2023.3.19. Organizations should upgrade to the appropriate patched version as the primary remediation. As interim mitigations, restrict network access to Tableau Server to trusted hosts only, enforce strict input validation at the network perimeter (e.g., WAF rules blocking absolute path patterns in upload requests), and monitor file upload activity for anomalous path values. Applying the principle of least privilege to the Tableau Server service account can also limit the blast radius of any successful exploitation (Salesforce Advisory).

The vulnerability received coverage from multiple cybersecurity news outlets including GBHackers, CyberSecurityNews, and CyberPress, which highlighted it alongside other critical Tableau Server flaws disclosed in the same advisory cycle (GBHackers, CyberSecurityNews). Black Kite included CVE-2025-52451 in its Focus Friday TPRM analysis, recommending third-party risk management actions for organizations using Tableau Server (Black Kite). Community reaction on social platforms such as Mastodon/infosec.exchange noted the disclosure promptly after publication, though overall sentiment reflects moderate concern given the absence of public exploits.