Salesforce Tableau Server Absolute Path Traversal Vulnerability

A vulnerability allowing absolute path traversal has been identified in Salesforce Tableau Server on Windows and Linux. This issue arises from improper input validation in the 'tabdoc api - create-data-source-from-file-upload' modules, allowing attackers to traverse directories and access restricted files. The vulnerability affects Tableau Server versions prior to 2025.1.3, 2024.2.12, and 2023.3.19.

Impact

Exploitation of this vulnerability allows for absolute path traversal, potentially leading to unauthorized access to files on the server.

Remediation

Users are advised to update Tableau Server to the latest supported maintenance release in their branch, available on the Tableau Server Maintenance Release page.