CVE-2025-26496

Salesforce Tableau Server and Tableau Desktop on Windows and Linux are vulnerable to a Type Confusion vulnerability within the File Upload modules . This flaw allows for Local Code Inclusion , potentially enabling attackers to upload and execute malicious files. The issue affects versions prior t...

CVE-2025-52452

A Path Traversal vulnerability exists in Salesforce Tableau Server on Windows and Linux operating systems. The flaw is located within the tabdoc api - duplicate-data-source modules , where incorrect restrictions on pathnames to the restricted-access catalog allow for Absolute Path Traversal . A m...

CVE-2025-52446

A vulnerability in the tab-doc api modules of Salesforce Tableau Server on Windows and Linux allows an authorization bypass via a user-controlled key. This flaw enables interface manipulation , potentially granting unauthorized access to the production database cluster. This issue impacts Tableau...

CVE-2025-52448

Salesforce Tableau Server is vulnerable to an authorization bypass via a user-controlled key within the validate-initial-sql API modules. This vulnerability allows an attacker to perform interface manipulation , potentially gaining unauthorized access to the production database cluster. The issue...

CVE-2025-52447

The Salesforce Tableau Server (Windows, Linux) is affected by an Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) in the set-initial-sql tabdoc command modules. This flaw allows an attacker, operating remotely, to bypass authentication and gain unauthorized access to prote...

CVE-2025-26497

Salesforce Tableau Server on Windows and Linux is vulnerable to an Unrestricted Upload of File with Dangerous Type vulnerability within the Flow Editor modules . This flaw allows an attacker to perform Absolute Path Traversal , potentially enabling the upload of files with dangerous types. The is...

CVE-2025-52449

A vulnerability in Salesforce Tableau Server (Windows and Linux) on versions prior to 2025.1.3 , prior to 2024.2.12 , and prior to 2023.3.19 allows for unrestricted upload of dangerous file types . The root cause is insufficient file type validation within the Extensible Protocol Service modules ...

CVE-2025-52453

A Server-Side Request Forgery (SSRF) vulnerability exists in the Flow Data Source modules of Salesforce Tableau Server running on Windows and Linux. The root cause is insufficient validation of queries on the server side, which allows an attacker to perform an SSRF attack and achieve Resource Loc...

CVE-2025-52455

A Server-Side Request Forgery (SSRF) vulnerability exists in the EPS Server modules of Salesforce Tableau Server on Windows and Linux platforms. The root cause is the insufficient validation of requests on the server side, which allows a remote attacker to perform an SSRF attack resulting in Reso...

CVE-2025-52454

A Server-Side Request Forgery (SSRF) vulnerability exists in Salesforce Tableau Server on Windows and Linux systems. The issue is caused by insufficient validation of queries within the Amazon S3 Connector modules , which allows for Resource Location Spoofing . This vulnerability affects Tableau ...

CVE-2025-26498

Salesforce Tableau Server is vulnerable to an Unrestricted Upload of File with Dangerous Type vulnerability affecting versions prior to 2025.1.3 , 2024.2.12 , and 2023.3.19 on both Windows and Linux platforms. The root cause lies in the establish-connection-no-undo modules, which allow for Absolu...

CVE-2025-52451

Salesforce Tableau Server on Windows and Linux is vulnerable to an Absolute Path Traversal flaw due to improper input validation in the tabdoc api - create-data-source-from-file-upload modules. This issue affects versions prior to 2025.1.3 , 2024.2.12 , and 2023.3.19 . To remediate this vulnerabi...

CVE-2025-52450

Salesforce Tableau Server on Windows and Linux is vulnerable to an Absolute Path Traversal vulnerability (CWE-22) within the abdoc api - create-data-source-from-file-upload modules. This issue is caused by the improper limitation of a pathname to a restricted directory . Affected versions include...