CVE-2025-52452 in Tableau Server
Summary
by MITRE • 07/25/2025
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows Absolute Path Traversal. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/13/2026
The CVE-2025-52452 vulnerability represents a critical path traversal flaw within Salesforce Tableau Server that specifically impacts both Windows and Linux operating systems. This vulnerability resides within the tabdoc api duplicate-data-source modules, where improper limitation of pathname parameters creates an avenue for absolute path traversal attacks. The flaw allows malicious actors to bypass directory restrictions and access files outside of the intended restricted directories, potentially exposing sensitive data and system resources. The vulnerability affects multiple versions of Tableau Server including releases prior to 2025.1.3, 2024.2.12, and 2023.3.19, indicating a long-standing issue that has persisted across several major releases. This type of vulnerability falls under CWE-22, which specifically addresses improper limitation of a pathname to a restricted directory, a fundamental security weakness that has been consistently documented in cybersecurity frameworks and standards.
The technical implementation of this vulnerability exploits the way Tableau Server processes pathname parameters within the tabdoc api functionality when handling duplicate-data-source operations. When the system processes user-supplied pathnames without adequate validation or sanitization, attackers can manipulate input parameters to traverse beyond the intended directory boundaries. This absolute path traversal capability enables adversaries to access system files, configuration data, and potentially sensitive user information that should remain isolated within designated directories. The impact extends beyond simple file access as it can provide attackers with insights into the underlying system architecture, file permissions, and potentially lead to further exploitation opportunities. The vulnerability's presence in the duplicate-data-source modules suggests that it specifically affects scenarios where Tableau Server handles data source duplication operations, which are common administrative tasks within the platform.
Operationally, this vulnerability poses significant risks to organizations relying on Tableau Server for data visualization and business intelligence. The absolute path traversal capability can enable attackers to extract database credentials, configuration files containing sensitive information, and potentially system-level files that could facilitate further compromise. Security teams face the challenge of monitoring and protecting against this specific attack vector while maintaining normal operational functionality. The vulnerability's impact is particularly concerning given that Tableau Server is widely deployed in enterprise environments where sensitive business data is processed and analyzed. Organizations may experience data breaches, compliance violations, and potential system compromise if this vulnerability remains unaddressed. The attack surface is expanded by the fact that this issue affects both Windows and Linux deployments, requiring security teams to implement mitigations across multiple platform environments.
Mitigation strategies for CVE-2025-52452 should prioritize immediate patching of affected Tableau Server installations to versions 2025.1.3, 2024.2.12, or 2023.3.19, depending on the current deployment. Organizations should also implement network segmentation and access controls to limit exposure of Tableau Server to untrusted networks. Input validation and sanitization measures should be strengthened within the tabdoc api modules to ensure that pathname parameters are properly validated before processing. Security monitoring should include detection of anomalous file access patterns and unusual directory traversal activities. Additionally, organizations should conduct comprehensive vulnerability assessments to identify any other potential path traversal vulnerabilities within their Tableau Server deployments and related systems. This vulnerability aligns with ATT&CK technique T1074.001 for data staging and T1566.001 for spearphishing attachments, as it could enable adversaries to extract sensitive data and potentially establish persistence through access to system configuration files. The remediation approach should follow established security frameworks including principle of least privilege, regular security updates, and comprehensive security monitoring to prevent exploitation of this and similar path traversal vulnerabilities.