https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-52451.htmlhttps://patchthecve.com/cve/CVE-2025-52451.htmlWed, 17 Jun 2026 09:36:31 +0000HIGH 8.5: Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.https://patchthecve.com/cve/CVE-2025-52450.htmlhttps://patchthecve.com/cve/CVE-2025-52450.htmlWed, 17 Jun 2026 09:36:30 +0000MEDIUM 6.5: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (abdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, bhttps://patchthecve.com/cve/CVE-2025-26498.htmlhttps://patchthecve.com/cve/CVE-2025-26498.htmlWed, 17 Jun 2026 09:01:55 +0000HIGH 7.3: Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.https://patchthecve.com/cve/CVE-2025-26497.htmlhttps://patchthecve.com/cve/CVE-2025-26497.htmlWed, 17 Jun 2026 09:01:55 +0000HIGH 7.3: Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.https://patchthecve.com/cve/CVE-2025-26496.htmlhttps://patchthecve.com/cve/CVE-2025-26496.htmlWed, 17 Jun 2026 09:01:55 +0000CRITICAL 9.3: Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.https://patchthecve.com/cve/CVE-2025-52455.htmlhttps://patchthecve.com/cve/CVE-2025-52455.htmlWed, 17 Jun 2026 09:36:31 +0000MEDIUM 5.3: Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.https://patchthecve.com/cve/CVE-2025-52454.htmlhttps://patchthecve.com/cve/CVE-2025-52454.htmlWed, 17 Jun 2026 09:36:31 +0000HIGH 8.2: Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.https://patchthecve.com/cve/CVE-2025-52453.htmlhttps://patchthecve.com/cve/CVE-2025-52453.htmlWed, 17 Jun 2026 09:36:31 +0000HIGH 8.2: Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.https://patchthecve.com/cve/CVE-2025-52452.htmlhttps://patchthecve.com/cve/CVE-2025-52452.htmlWed, 17 Jun 2026 09:36:31 +0000HIGH 8.5: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows Absolute Path Traversal. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3https://patchthecve.com/cve/CVE-2025-52449.htmlhttps://patchthecve.com/cve/CVE-2025-52449.htmlWed, 17 Jun 2026 09:36:30 +0000HIGH 8.5: Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.https://patchthecve.com/cve/CVE-2025-52448.htmlhttps://patchthecve.com/cve/CVE-2025-52448.htmlWed, 17 Jun 2026 09:36:30 +0000HIGH 8.1: Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, beforhttps://patchthecve.com/cve/CVE-2025-52447.htmlhttps://patchthecve.com/cve/CVE-2025-52447.htmlWed, 17 Jun 2026 09:36:30 +0000HIGH 8.1: Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12,https://patchthecve.com/cve/CVE-2025-52446.htmlhttps://patchthecve.com/cve/CVE-2025-52446.htmlWed, 17 Jun 2026 09:36:30 +0000HIGH 8.0: Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.https://patchthecve.com/cve/CVE-2025-26495.htmlhttps://patchthecve.com/cve/CVE-2025-26495.htmlWed, 17 Jun 2026 09:01:54 +0000HIGH 7.5: Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.https://patchthecve.com/cve/CVE-2025-26494.htmlhttps://patchthecve.com/cve/CVE-2025-26494.htmlWed, 17 Jun 2026 09:01:54 +0000HIGH 7.7: Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server allows Authentication Bypass.This issue affects Tableau Server: from 2023.3 through 2023.3.5.