Introduction
Local code inclusion in an enterprise analytics platform can lead to full system compromise and unauthorized access to sensitive business data. Salesforce Tableau recently had a critical vulnerability in its file upload modules that could allow attackers to execute arbitrary code.
About Salesforce Tableau: Tableau is a business intelligence and data visualization platform that Salesforce acquired in 2019. Thousands of enterprises use it for analytics and reporting. Its integration with Salesforce's cloud ecosystem makes it central to many organizations' data strategies.
Technical Information
CVE-2025-26496 is a type confusion vulnerability (CWE-843) in the file upload modules of Tableau Server and Tableau Desktop. Type confusion happens when a resource is allocated or initialized as one type and later accessed as another. The mismatch causes logic errors and can enable memory corruption or code execution. Here, Tableau mishandles uploaded files, and attackers can exploit the resulting type mismatch to achieve local code inclusion.
The vulnerability affects both Windows and Linux versions, which points to a flaw in core application logic rather than platform-specific code. An attacker with file upload access can craft a file that triggers the type confusion and runs arbitrary code within the Tableau application context. No public code snippets or proof of concept are available for this vulnerability.
Affected Systems and Versions
- Tableau Server (Windows and Linux): versions before 2025.1.3
- Tableau Server (Windows and Linux): versions before 2024.2.12
- Tableau Server (Windows and Linux): versions before 2023.3.19
- Tableau Desktop (Windows and Linux): versions before 2025.1.3
- Tableau Desktop (Windows and Linux): versions before 2024.2.12
- Tableau Desktop (Windows and Linux): versions before 2023.3.19
Any deployment running these versions is vulnerable if it exposes file upload functionality.
Vendor Security History
Tableau products had several other critical vulnerabilities in 2025, including file upload flaws (CVE-2025-52449), authorization bypasses (CVE-2025-52446, CVE-2025-52447, CVE-2025-52448), and path traversal issues (CVE-2025-52452). Salesforce typically issues coordinated advisories and patches for vulnerabilities like these. Severe flaws in Tableau's file handling and input validation have turned up repeatedly, which points to ongoing weaknesses in both areas.
