CVE-2025-3115

Spotfire Data Function Vulnerability

Critical9.4EPSS 0.68%

Published: 9 Apr 2025
Updated: 11 Nov 2025
Reserved: 2 Apr 2025
Assigned by: tibco

Description

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution

Scores

CVSS scores of CVE-2025-3115, by who scored it
Scored by	CVSS	Score	Vector
tibcoCNA (assigner)	4.0	Critical9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVDNVD · Modified	4.0	Critical9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.68% · top 47% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.

Weakness

CWE-94 Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs

Affected products

Spotfire · Spotfire Statistics Services
- affected 14 – < 14.0.7
- affected 14.1.0
- affected 14.2.0
- affected 14.3.0
- affected 14.4.0
- affected 14.4.1
Spotfire · Spotfire Analyst
- affected 14.0 – < 14.0.6
- affected 14.1.0
- affected 14.2.0
- affected 14.3.0
- affected 14.4.0
- affected 14.4.1
Spotfire · Deployment Kit used in Spotfire Server
- affected 14.0 – < 14.0.7
- affected 14.1.0
- affected 14.2.0
- affected 14.3.0
- affected 14.4.0
- affected 14.4.1
Spotfire · Spotfire Desktop
- affected 14.4 – < 14.4.2
Spotfire · Spotfire for AWS Marketplace
- unknown 14.4 – < 14.4.2
Spotfire · Spotfire Enterprise Runtime for R - Server Edition
- affected 1.17 – < 1.17.7
- affected 1.18.0
- affected 1.19.0
- affected 1.20.0
- affected 1.21.0
- affected 1.21.1
Spotfire · Spotfire Service for Python
- affected 1.17 – < 1.17.7
- affected 1.18.0 – ≤ 1.21.1
Spotfire · Spotfire Service for R
- affected 1.17 – < 1.17.7
- affected 1.18.0 – ≤ 1.21.1

References (1)

https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3115-r3485/ (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-3115](https://trackcve.app/badge/CVE-2025-3115.svg)](https://trackcve.app/cve/CVE-2025-3115)

Record last updated 11 Nov 2025, 11:47 UTC.