CVE-2025-3115

An attacker with authenticated access (low privileges) can inject malicious code into functions executed by the platform (CWE-94 — code injection). At the same time, insufficient validation of file names during upload allows uploading a file with a crafted name, which can then be executed by the server. Both vectors lead to arbitrary code execution on the server side.

An attacker can gain full control over the system executing vulnerable functions, including server data and resources. If the attack is successful, it is also possible to compromise the confidentiality, integrity, and availability of related systems (high impact on external systems according to CVSS vector).

Patches available from the manufacturer should be applied in accordance with the references — detailed information about affected and patched versions is available in the official Tibco Spotfire security bulletin dated 2025-04-08: https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3115-r3485/

Tibco Spotfire Analytics Platform, Tibco Spotfire Analyst, Tibco Spotfire Desktop, Tibco Spotfire Deployment Kit, Tibco Spotfire Statistics Services — specific versions indicated in the manufacturer's references.