CVE-2025-52452
Published: 25 July 2025
Summary
CVE-2025-52452 is a high-severity Path Traversal (CWE-22) vulnerability in Tableau Tableau Server. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates path traversal by requiring validation of pathname inputs in the tabdoc API to prevent absolute path traversal outside restricted directories.
Addresses the specific flaw in Tableau Server's duplicate-data-source modules through timely patching to vulnerable versions' fixed releases.
Enforces access controls to limit low-privileged users from accessing or manipulating files outside authorized directories despite traversal attempts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in exposed tabdoc API directly enables remote exploitation of public-facing server (T1190) and arbitrary local file/directory access (T1005, T1083).
NVD Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows Absolute Path Traversal. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Deeper analysisAI
CVE-2025-52452 is an Improper Limitation of a Pathname to a Restricted Directory vulnerability, classified as Absolute Path Traversal (CWE-22), in Salesforce Tableau Server on Windows and Linux. The flaw affects the tabdoc API's duplicate-data-source modules and impacts Tableau Server versions before 2025.1.3, before 2024.2.12, and before 2023.3.19. Published on 2025-07-25, it carries a CVSS v3.1 base score of 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
A low-privileged authenticated user (PR:L) can exploit this vulnerability over the network (AV:N) without requiring user interaction (UI:N), though it demands high attack complexity (AC:H). Exploitation enables severe impacts, including high confidentiality, integrity, and availability disruptions (C:H/I:H/A:H), with a change in scope (S:C) that allows attackers to access or manipulate files outside intended directories via absolute path traversal.
Salesforce advisories detail mitigation through upgrading to patched versions: Tableau Server 2025.1.3, 2024.2.12, 2023.3.19, or later. Additional guidance is available at https://help.salesforce.com/s/articleView?id=005105043&type=1.
Details
- CWE(s)