critical9.8
CVE-2025-3115
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions.
Impact
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tibco | Spotfire Enterprise Runtime For R | before 6.1.5 before 1.17.7 Versions 1.18.0, 1.19.0, 1.20.0, 1.21.0 |
| Tibco | Spotfire Statistics Services | before 14.0.7 Versions 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 |
| Tibco | Spotfire Analyst | before 14.0.6 Versions 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 |
| Tibco | Spotfire Deployment Kit | before 14.0.7 Versions 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 |
| Tibco | Spotfire Desktop | before 14.4.2 |
| Tibco | Spotfire Analytics Platform | before 14.4.2 |