Description
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVSS Metrics
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- Attack Vector
- adjacent network
- Complexity
- low
- Privileges
- none
- User Action
- required
- Scope
- changed
- Confidentiality
- high
- Integrity
- high
- Availability
- none
- Weaknesses
- CWE-434
Metadata
- Primary Vendor
- TABLEAU
- Published
- 7/25/2025
- Last Modified
- 10/31/2025
- Source
- NIST NVD
- Note: Verify all details with official vendor sources before applying patches.
Affected Products
tableau : tableau_servertableau : tableau_servertableau : tableau_server
AI-Powered Remediation
Generate remediation guidance or a C-suite brief for this vulnerability.