Introduction
A single crafted API request can expose sensitive files on an enterprise analytics server. Any organization running Tableau Server below the latest patch levels is at risk of unauthorized file access through a critical path traversal vulnerability in the platform's file upload API.
About the involved software: Salesforce sells enterprise cloud software to millions of users, with a portfolio that includes CRM, analytics, and business intelligence. Tableau, which Salesforce acquired in 2019, is an analytics and data visualization platform that enterprises around the world use for critical business intelligence workloads.
Technical Information
CVE-2025-52451 is an improper input validation vulnerability in the create-data-source-from-file-upload modules of Tableau Server's tabdoc API. It allows absolute path traversal on both Windows and Linux deployments. An attacker can put a crafted file path in an API request and access arbitrary files on the host system, getting around the directory restrictions the endpoint is meant to enforce. The root cause is that the affected endpoint does not properly sanitize or validate user-supplied path parameters. The flaw is classified as CWE-20 (Improper Input Validation).
No public code snippets or proof of concept have been released. The issue is exploitable over the network and needs no privileges beyond basic API access. By specifying absolute paths in the file upload functionality, an attacker may be able to expose configuration files, credentials, or other sensitive data that the Tableau Server process can read.
Affected Systems and Versions
- Tableau Server on Windows and Linux
- Affected versions:
- All versions before 2025.1.3
- All versions before 2024.2.12
- All versions before 2023.3.19
- The vulnerability exists in the tabdoc API create-data-source-from-file-upload modules
Vendor Security History
Salesforce has previously fixed several critical vulnerabilities in Tableau Server, including:
- Authorization bypass (CVE-2025-52446, CVE-2025-52447, CVE-2025-52448)
- Remote code execution via unrestricted file upload (CVE-2025-52449)
- Path traversal in related API modules (CVE-2025-52452)
- SSRF and authentication bypass issues in earlier advisories
Salesforce usually issues coordinated advisories and patches across its supported branches and contacts administrators directly. The June 2025 advisory alone disclosed eight critical vulnerabilities, which points to ongoing trouble with secure input handling and access control in Tableau Server.
