CVE-2025-26498
BaseFortify
Publication date: 2025-08-22
Last updated on: 2025-11-03
Assigner: Salesforce, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tableau | tableau_server | to 2023.3.19 (exc) |
| tableau | tableau_server | From 2024.2 (inc) to 2024.2.12 (exc) |
| tableau | tableau_server | From 2025.1 (inc) to 2025.1.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Unrestricted Upload of File with Dangerous Type in Salesforce Tableau Server on Windows and Linux. It allows Absolute Path Traversal, meaning an attacker could upload files with dangerous types and potentially access or overwrite files outside the intended directories. This affects versions of Tableau Server before 2025.1.3, 2024.2.12, and 2023.3.19.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to upload malicious files and perform Absolute Path Traversal, which may lead to unauthorized access, modification, or deletion of files on the server. This could compromise the integrity and security of the Tableau Server environment.