What’s Vulnerable › Vulnerabilities
CVE-2025-3115: Spotfire Data Function Vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-04-09 · updated 2026-06-17
- Weakness: CWE-94
Description
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution
Affected products
- TIBCO Spotfire Analyst: before 14.0.6; 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 — fixed in 14.0.6
- TIBCO Spotfire Analytics Platform: before 14.4.2 — fixed in 14.4.2
- TIBCO Spotfire Deployment Kit: before 14.0.7; 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 — fixed in 14.0.7
- TIBCO Spotfire Desktop: before 14.4.2 — fixed in 14.4.2
- TIBCO Spotfire Enterprise Runtime For R: before 6.1.5; before 1.17.7; 1.18.0, 1.19.0, 1.20.0, 1.21.0, 1.21.1 — fixed in 1.17.7, 6.1.5
- TIBCO Software Inc. TIBCO Spotfire Statistics Services: before 14.0.7; 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 — fixed in 14.0.7
How to fix
Upgrade to a fixed version: TIBCO Spotfire Analyst 14.0.6; TIBCO Spotfire Analytics Platform 14.4.2; TIBCO Spotfire Deployment Kit 14.0.7; TIBCO Spotfire Desktop 14.4.2; TIBCO Spotfire Enterprise Runtime For R 1.17.7, 6.1.5; TIBCO Software Inc. TIBCO Spotfire Statistics Services 14.0.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-3115 or the next vulnerability affects your stack