CVE-2025-26498: Tableau Server Path Traversal Vulnerability

CVE-2025-26498 Overview

CVE-2025-26498 is an Unrestricted Upload of File with Dangerous Type vulnerability affecting Salesforce Tableau Server on Windows and Linux platforms. The vulnerability exists within the establish-connection-no-undo modules and enables attackers to perform Absolute Path Traversal attacks. By exploiting this flaw, unauthenticated remote attackers can upload malicious files to arbitrary locations on the server, potentially leading to remote code execution, data exfiltration, or complete system compromise.

Critical Impact

This vulnerability allows unauthenticated remote attackers to upload dangerous file types to arbitrary paths on Tableau Server systems, potentially enabling remote code execution and full server compromise.

Affected Products

• Tableau Server versions prior to 2025.1.3
• Tableau Server versions prior to 2024.2.12
• Tableau Server versions prior to 2023.3.19

Discovery Timeline

• 2025-08-22 - CVE-2025-26498 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-26498

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), a critical weakness that occurs when an application allows users to upload files without properly validating the file type, content, or destination path. In the context of Tableau Server, the establish-connection-no-undo modules fail to adequately validate and restrict file uploads, allowing attackers to bypass intended security controls.

The attack can be conducted remotely over the network without requiring authentication or user interaction. Successful exploitation impacts the confidentiality, integrity, and availability of the target system. Attackers can leverage this vulnerability to upload web shells, malicious executables, or configuration files that could lead to persistent access or further exploitation.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the file upload functionality of Tableau Server's establish-connection-no-undo modules. The application fails to properly sanitize file paths provided during upload operations, enabling absolute path traversal. Additionally, the lack of file type restrictions allows dangerous file types to be uploaded, which can be subsequently executed on the server.

Attack Vector

The vulnerability is exploited via network-based attacks targeting Tableau Server installations. An attacker can craft malicious HTTP requests to the vulnerable upload endpoint, specifying arbitrary file paths using path traversal sequences. The attack does not require authentication or user interaction, making it particularly dangerous for internet-facing Tableau Server deployments.

The exploitation flow involves:

1. Identifying a vulnerable Tableau Server instance
2. Crafting a malicious upload request targeting the establish-connection-no-undo modules
3. Specifying an arbitrary destination path using absolute path traversal techniques
4. Uploading a dangerous file type (e.g., web shell, executable)
5. Accessing or triggering the uploaded file to achieve code execution

Detection Methods for CVE-2025-26498

Indicators of Compromise

• Unexpected files appearing in web-accessible directories or system locations outside normal Tableau data paths
• Suspicious HTTP POST requests to endpoints associated with the establish-connection-no-undo modules containing path traversal sequences
• New or modified files with executable extensions (.jsp, .exe, .sh, .bat) in Tableau Server directories
• Anomalous outbound network connections originating from Tableau Server processes

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns (e.g., ../, absolute paths) in file upload requests
• Monitor Tableau Server logs for unusual file upload activity, particularly requests containing path manipulation characters
• Deploy file integrity monitoring (FIM) on critical Tableau Server directories to detect unauthorized file creations or modifications
• Configure intrusion detection systems (IDS) to alert on suspicious POST requests to Tableau Server upload endpoints

Monitoring Recommendations

• Enable verbose logging for Tableau Server web services and review logs regularly for anomalous upload patterns
• Implement real-time alerting for file system changes in Tableau Server installation directories
• Monitor network traffic for unusual file uploads or data exfiltration attempts from Tableau Server hosts
• Establish baseline behavior for Tableau Server file operations to identify deviations

How to Mitigate CVE-2025-26498

Immediate Actions Required

• Update Tableau Server to version 2025.1.3, 2024.2.12, or 2023.3.19 or later immediately
• If immediate patching is not possible, restrict network access to Tableau Server to trusted networks only
• Implement WAF rules to block path traversal attempts targeting upload endpoints
• Review file systems for any unauthorized files that may indicate prior exploitation

Patch Information

Salesforce has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• Tableau Server 2025.1.3 or later
• Tableau Server 2024.2.12 or later
• Tableau Server 2023.3.19 or later

Refer to the Salesforce Help Article for detailed patch information and upgrade instructions.

Workarounds

• Place Tableau Server behind a reverse proxy or WAF configured to filter path traversal and malicious file upload attempts
• Restrict network access to Tableau Server using firewall rules, limiting exposure to trusted IP ranges only
• Implement application-level access controls to restrict upload functionality to authenticated and authorized users
• Monitor and audit all file upload activities pending the application of security patches

# Example: Restrict access to Tableau Server using iptables
# Allow access only from trusted network (e.g., 10.0.0.0/8)
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Verify Tableau Server version
tsm version