Salesforce Tableau Server Absolute Path Traversal Vulnerability

A path traversal vulnerability allowing absolute path traversal has been identified in Salesforce Tableau Server. This issue affects versions prior to 2025.1.3, 2024.2.12, and 2023.3.19 on both Windows and Linux. The vulnerability arises from improper limitation of pathnames to restricted directories, specifically in the 'tabdoc api - create-data-source-from-file-upload' modules.

Impact

Exploitation of this vulnerability allows for absolute path traversal, potentially leading to unauthorized access to files on the server.

Remediation

Users are advised to update Tableau Server to the latest supported maintenance release in their branch, available on the Tableau Server Maintenance Release page.