CVE-2025-3115 - CVE House
Back to Database
Status published Critical CVE-2025-3115

Spotfire Data Function Vulnerability

Vulnerability Description

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3115

Credits & Attribution

No credits recorded in the NVD database.

References

More from Spotfire

View All →
CVE-2025-3114
Spotfire Code Execution Vulnerability
Critical 9.4
CVE-2024-3331
Spotfire: NTLM token leakage
Medium 6.8
CVE-2024-3330
Spotfire Remote Code Execution Vulnerability
Critical 9.9

Affected Vendor

Affected Software

Spotfire Statistics Services, Spotfire Analyst, Deployment Kit used in Spotfire Server, Spotfire Desktop, Spotfire for AWS Marketplace, Spotfire Enterprise Runtime for R - Server Edition, Spotfire Service for Python, Spotfire Service for R
Vulnerable Versions:
14, 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1, 14.0, 14.4, 1.17, 1.18.0, 1.19.0, 1.20.0, 1.21.0, 1.21.1

Timeline

Official Publish: April 9th, 2025
Last Modified: November 11th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.