CVE-2025-52450: Tableau Server Path Traversal Vulnerability

CVE-2025-52450 Overview

CVE-2025-52450 is an absolute path traversal vulnerability in Salesforce Tableau Server on Windows and Linux. The flaw resides in the abdoc API within the create-data-source-from-file-upload modules. An authenticated attacker with low privileges can supply an absolute path to access files outside the intended upload directory over the network. The issue affects Tableau Server versions before 2025.1.3, 2024.2.12, and 2023.3.19. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated attackers can read arbitrary files on the Tableau Server host, exposing configuration files, credentials, and business intelligence assets.

Affected Products

Tableau Server on Windows (versions before 2025.1.3, 2024.2.12, 2023.3.19)
Tableau Server on Linux (versions before 2025.1.3, 2024.2.12, 2023.3.19)
abdoc API create-data-source-from-file-upload modules

Discovery Timeline

2025-08-22 - CVE-2025-52450 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52450

Vulnerability Analysis

The vulnerability exists in the abdoc API endpoints responsible for creating data sources from uploaded files. The affected modules accept file path input without proper validation against a canonical base directory. Because the flaw permits absolute path traversal, an attacker does not need to rely on ../ sequence normalization tricks. Instead, the attacker can supply a fully qualified path such as /etc/passwd on Linux or C:\Windows\win.ini on Windows. The service processes the specified path as if it were a legitimate upload target, resulting in confidentiality impact on files readable by the Tableau Server process account.

Root Cause

The root cause is missing pathname canonicalization and restriction enforcement in the file handling logic of the create-data-source-from-file-upload modules. The server accepts user-controlled path parameters and dereferences them without verifying that the resolved path stays within an allowed directory. Absolute paths bypass any relative-path filtering that may be in place.

Attack Vector

Exploitation requires network access to the Tableau Server and low-privilege authenticated credentials. No user interaction is required. An attacker submits a crafted request to the vulnerable abdoc API endpoint containing an absolute file path in a parameter expected to reference an upload location. The server reads the targeted file and exposes its contents through the data source creation workflow.

No public proof-of-concept exploit is available at this time. Review the Salesforce Help Article for vendor-provided technical guidance.

Detection Methods for CVE-2025-52450

Indicators of Compromise

HTTP requests to abdoc API endpoints containing absolute file paths such as /etc/, /var/, C:\Windows\, or C:\Users\ in request parameters.
Unexpected data source creation events referencing system files or files outside typical Tableau content directories.
Access log entries showing repeated create-data-source-from-file-upload calls from a single authenticated session.

Detection Strategies

Inspect Tableau Server application logs for abdoc API calls with path parameters that begin with drive letters, UNC prefixes, or root filesystem markers.
Correlate authenticated user sessions with anomalous file access patterns using SIEM rules aligned to CWE-22.
Alert on any Tableau data source creation referencing paths outside the sanctioned repository directory.

Monitoring Recommendations

Enable verbose logging for the abdoc API and forward events to a centralized log platform.
Monitor egress from Tableau Server hosts for exfiltration of large or sensitive file contents following API interactions.
Track privilege usage of low-privilege Tableau accounts to detect account compromise or misuse.

How to Mitigate CVE-2025-52450

Immediate Actions Required

Upgrade Tableau Server to version 2025.1.3, 2024.2.12, 2023.3.19, or later based on your maintenance branch.
Audit existing Tableau accounts and revoke unnecessary low-privilege access that could be leveraged for authenticated exploitation.
Review recent abdoc API activity in server logs for signs of prior exploitation attempts.

Patch Information

Salesforce has released fixed versions of Tableau Server. Refer to the Salesforce Help Article for official patch details and upgrade instructions. Administrators should apply the patch corresponding to their deployment branch.

Workarounds

Restrict network access to Tableau Server management and API endpoints to trusted administrative networks only.
Enforce strict least-privilege on Tableau Server accounts and require multi-factor authentication to reduce the risk of credential abuse.
Run the Tableau Server service account with minimum filesystem permissions so traversal reads cannot reach sensitive OS files.

bash

# Configuration example: verify installed Tableau Server version
tsm version

# Linux: restrict Tableau service account filesystem access
chmod 750 /var/opt/tableau
chown -R tableau:tableau /var/opt/tableau