CVE-2025-52452: Tableau Server Path Traversal Flaw

CVE-2025-52452 Overview

CVE-2025-52452 is a critical Path Traversal vulnerability affecting Salesforce Tableau Server on both Windows and Linux platforms. The vulnerability exists within the tabdoc API, specifically in the duplicate-data-source modules, allowing authenticated attackers to perform Absolute Path Traversal attacks. This flaw enables malicious actors to access files and directories outside the intended restricted directory structure, potentially leading to unauthorized data access, information disclosure, or system compromise.

Critical Impact

This vulnerability allows authenticated attackers to traverse directory structures and access sensitive files outside the application's root directory, potentially exposing configuration files, credentials, and other critical system data on affected Tableau Server installations.

Affected Products

• Tableau Server versions before 2025.1.3
• Tableau Server versions before 2024.2.12
• Tableau Server versions before 2023.3.19
• Affected platforms: Windows and Linux

Discovery Timeline

• 2025-07-25 - CVE-2025-52452 published to NVD
• 2025-10-31 - Last updated in NVD database

Technical Details for CVE-2025-52452

Vulnerability Analysis

This Path Traversal vulnerability (CWE-22) resides in the tabdoc API's duplicate-data-source modules within Tableau Server. The vulnerability allows an authenticated attacker with low privileges to escape the intended directory restrictions and access arbitrary files on the system. The scope is changed, meaning successful exploitation can affect resources beyond the vulnerable component's security scope, potentially impacting the confidentiality, integrity, and availability of data across the entire server environment.

The network-accessible attack vector combined with the potential for cross-scope impact makes this vulnerability particularly concerning for organizations with internet-facing Tableau Server deployments. While exploitation requires valid user credentials and involves high attack complexity, the potential consequences of successful exploitation are severe.

Root Cause

The root cause of CVE-2025-52452 lies in improper input validation within the tabdoc API when processing file path parameters in the duplicate-data-source functionality. The application fails to adequately sanitize or validate user-supplied path components, allowing attackers to inject directory traversal sequences (such as ../) or absolute paths that escape the intended directory structure.

This improper limitation of pathname handling enables attackers to reference files and directories outside the application's designated working directory, bypassing access controls that should restrict file system access to authorized locations only.

Attack Vector

The attack is conducted over the network against the Tableau Server's tabdoc API endpoint. An authenticated attacker with valid low-privilege credentials can craft malicious requests to the duplicate-data-source module containing path traversal sequences.

The exploitation flow involves:

1. The attacker authenticates to Tableau Server with valid credentials
2. A request is sent to the tabdoc API's duplicate-data-source functionality
3. The request contains manipulated file path parameters with directory traversal sequences
4. Due to insufficient path validation, the server processes the malicious path
5. The attacker gains access to files outside the intended directory scope

The attack allows for absolute path traversal, enabling direct access to any file readable by the Tableau Server process, including system configuration files, application data, and potentially sensitive credentials stored on the server.

Detection Methods for CVE-2025-52452

Indicators of Compromise

• Unusual API requests to the tabdoc endpoint containing path traversal sequences like ../, ..\\, or absolute path prefixes
• Server logs showing access to files outside normal Tableau Server data directories
• Requests to the duplicate-data-source module with malformed or suspicious path parameters
• Unexpected file access patterns from the Tableau Server process

Detection Strategies

• Monitor Tableau Server access logs for requests containing directory traversal patterns (../, ..%2f, %2e%2e/)
• Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts in API requests
• Enable detailed logging for the tabdoc API and analyze for anomalous path parameters
• Deploy intrusion detection systems (IDS) with signatures for path traversal attack patterns

Monitoring Recommendations

• Configure SIEM alerts for path traversal patterns in Tableau Server logs
• Monitor file system access by the Tableau Server process for unusual directory access outside expected paths
• Review authentication logs for accounts accessing sensitive API endpoints
• Implement behavioral analytics to detect unusual data source duplication patterns

How to Mitigate CVE-2025-52452

Immediate Actions Required

• Upgrade Tableau Server to version 2025.1.3, 2024.2.12, or 2023.3.19 depending on your deployment branch
• Review access logs for evidence of exploitation attempts
• Restrict network access to Tableau Server to trusted networks where possible
• Audit user accounts with access to the duplicate-data-source functionality

Patch Information

Salesforce has released security patches addressing this vulnerability. Organizations should upgrade to the following versions or later:

• Tableau Server 2025.1.3 (for 2025.x deployments)
• Tableau Server 2024.2.12 (for 2024.x deployments)
• Tableau Server 2023.3.19 (for 2023.x deployments)

For detailed patch information and upgrade instructions, refer to the Salesforce Help Article.

Workarounds

• Implement network segmentation to limit access to Tableau Server from untrusted networks
• Deploy a Web Application Firewall (WAF) with rules to block requests containing path traversal sequences
• Restrict user permissions to minimize the number of accounts with access to data source duplication features
• Monitor and audit all API access to the tabdoc endpoint until patches can be applied

# Example WAF rule pattern to block path traversal attempts
# This is a conceptual example - adjust for your specific WAF platform
# Block requests containing directory traversal sequences
SecRule REQUEST_URI "@contains ../" "id:100001,phase:1,deny,status:403,msg:'Path Traversal Attempt'"
SecRule REQUEST_URI "@contains ..%2f" "id:100002,phase:1,deny,status:403,msg:'Encoded Path Traversal Attempt'"
SecRule ARGS "@contains ../" "id:100003,phase:2,deny,status:403,msg:'Path Traversal in Parameters'"