CVE-2025-26496

Salesforce Tableau Server and Tableau Desktop on Windows and Linux are vulnerable to a Type Confusion vulnerability within the File Upload modules . This flaw allows for Local Code Inclusion , potentially enabling attackers to upload and execute malicious files. The issue affects versions prior t...

CVE-2025-52452

Salesforce Tableau Server on Windows and Linux is vulnerable to an Absolute Path Traversal vulnerability (CVE-2025-52452). The issue resides within the tabdoc api and duplicate-data-source modules due to improper limitation of pathnames to a restricted directory. A malicious actor could exploit t...

CVE-2025-52446

A vulnerability in Salesforce Tableau Server (Windows and Linux) allows for an authorization bypass via a user-controlled key in the tab-doc API modules . This flaw enables interface manipulation and could grant an intruder remote access to protected information, specifically the production datab...

CVE-2025-52448

A vulnerability in Salesforce Tableau Server on Windows and Linux allows for an authorization bypass due to insufficient validation of the validate-initial-sql API modules. Specifically, a user-controlled key can be exploited to perform interface manipulation , which may grant unauthorized access...

CVE-2025-52447

Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2....

CVE-2025-52455

Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.

CVE-2025-26497

Salesforce Tableau Server is vulnerable to an Unrestricted Upload of File with Dangerous Type in the Flow Editor modules on Windows and Linux. This flaw allows for Absolute Path Traversal , potentially enabling attackers to upload files of dangerous types to unauthorized locations. The vulnerabil...

CVE-2025-52453

A Server-Side Request Forgery (SSRF) vulnerability exists in Salesforce Tableau Server on Windows and Linux platforms. The issue is caused by insufficient validation of queries within the Flow Data Source modules , which allows for Resource Location Spoofing . Affected versions include those prio...

CVE-2025-52449

A vulnerability in Salesforce Tableau Server (Windows and Linux) on versions prior to 2025.1.3 , prior to 2024.2.12 , and prior to 2023.3.19 allows for unrestricted upload of dangerous file types . The root cause is insufficient file type validation within the Extensible Protocol Service modules ...

CVE-2025-52454

A Server-Side Request Forgery (SSRF) vulnerability exists in Salesforce Tableau Server on Windows and Linux systems. The issue is caused by insufficient validation of queries within the Amazon S3 Connector modules , which allows for Resource Location Spoofing . This vulnerability affects Tableau ...

CVE-2025-52451

Salesforce Tableau Server on Windows and Linux is vulnerable to an Absolute Path Traversal vulnerability due to improper input validation in the tabdoc api - create-data-source-from-file-upload modules. This flaw allows an attacker to traverse the file system. Affected versions include those prio...

CVE-2025-52450

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (abdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12...

CVE-2025-26498

Salesforce Tableau Server is vulnerable to an unrestricted file upload issue within the establish-connection-no-undo modules. This flaw allows for absolute path traversal on both Windows and Linux systems. The vulnerability affects versions prior to 2025.1.3 , 2024.2.12 , and 2023.3.19 . To remed...