CVE-2025-3115 - Spotfire Data Function Vulnerability

Back Back to CVE browser

CRITICAL

Spotfire Data Function Vulnerability

Published Apr 9, 2025

9.4

CRITICAL

CVSS 4.0

EPSS 0.67%

Description

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution

Affected products

Vendor Spotfire Product Deployment Kit used in Spotfire Server Default
n/a
- Version
  14.0
  Status
  affected
  Constraints
  <14.0.7
- Version
  14.1.0
  Status
  affected
  Constraints
  -
- Version
  14.2.0
  Status
  affected
  Constraints
  -
- Version
  14.3.0
  Status
  affected
  Constraints
  -
- Version
  14.4.0
  Status
  affected
  Constraints
  -
- Version
  14.4.1
  Status
  affected
  Constraints
  -
Vendor Spotfire Product Spotfire Analyst Default
n/a
- Version
  14.0
  Status
  affected
  Constraints
  <14.0.6
- Version
  14.1.0
  Status
  affected
  Constraints
  -
- Version
  14.2.0
  Status
  affected
  Constraints
  -
- Version
  14.3.0
  Status
  affected
  Constraints
  -
- Version
  14.4.0
  Status
  affected
  Constraints
  -
- Version
  14.4.1
  Status
  affected
  Constraints
  -
Vendor Spotfire Product Spotfire Desktop Default
n/a
- Version
  14.4
  Status
  affected
  Constraints
  <14.4.2
Vendor Spotfire Product Spotfire Enterprise Runtime for R - Server Edition Default
n/a
- Version
  1.17
  Status
  affected
  Constraints
  <1.17.7
- Version
  1.18.0
  Status
  affected
  Constraints
  -
- Version
  1.19.0
  Status
  affected
  Constraints
  -
- Version
  1.20.0
  Status
  affected
  Constraints
  -
- Version
  1.21.0
  Status
  affected
  Constraints
  -
- Version
  1.21.1
  Status
  affected
  Constraints
  -
Vendor Spotfire Product Spotfire Service for Python Default
n/a
- Version
  1.17
  Status
  affected
  Constraints
  <1.17.7
- Version
  1.18.0
  Status
  affected
  Constraints
  <=1.21.1
Vendor Spotfire Product Spotfire Service for R Default
n/a
- Version
  1.17
  Status
  affected
  Constraints
  <1.17.7
- Version
  1.18.0
  Status
  affected
  Constraints
  <=1.21.1
Vendor Spotfire Product Spotfire Statistics Services Default
unaffected
- Version
  14
  Status
  affected
  Constraints
  <14.0.7
- Version
  14.1.0
  Status
  affected
  Constraints
  -
- Version
  14.2.0
  Status
  affected
  Constraints
  -
- Version
  14.3.0
  Status
  affected
  Constraints
  -
- Version
  14.4.0
  Status
  affected
  Constraints
  -
- Version
  14.4.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Spotfire

Deployment Kit used in Spotfire Server

n/a

Version	Status	Constraints
14.0	affected	<14.0.7
14.1.0	affected	-
14.2.0	affected	-
14.3.0	affected	-
14.4.0	affected	-
14.4.1	affected	-

Spotfire

Spotfire Analyst

n/a

Version	Status	Constraints
14.0	affected	<14.0.6
14.1.0	affected	-
14.2.0	affected	-
14.3.0	affected	-
14.4.0	affected	-
14.4.1	affected	-

Spotfire

Spotfire Desktop

n/a

Version	Status	Constraints
14.4	affected	<14.4.2

Spotfire

Spotfire Enterprise Runtime for R - Server Edition

n/a

Version	Status	Constraints
1.17	affected	<1.17.7
1.18.0	affected	-
1.19.0	affected	-
1.20.0	affected	-
1.21.0	affected	-
1.21.1	affected	-

Spotfire

Spotfire Service for Python

n/a

Version	Status	Constraints
1.17	affected	<1.17.7
1.18.0	affected	<=1.21.1

Spotfire

Spotfire Service for R

n/a

Version	Status	Constraints
1.17	affected	<1.17.7
1.18.0	affected	<=1.21.1

Spotfire

Spotfire Statistics Services

unaffected

Version	Status	Constraints
14	affected	<14.0.7
14.1.0	affected	-
14.2.0	affected	-
14.3.0	affected	-
14.4.0	affected	-
14.4.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (1)

https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3115-r3485/

Link	Providers	Tags
https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3115-r3485/

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner tibco

Published Apr 9, 2025

Updated Nov 11, 2025

Reserved Apr 2, 2025

Link CVE-2025-3115

CISA Vulnrichment

Updated Apr 9, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2025-3115

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-3115