← Vulnerability feed

Vulnerability record · CVE-2025-3115 · published 9 April 2025

CVE-2025-3115: Tibco spotfire enterprise runtime for r code injection vulnerability

Tibco · Spotfire Enterprise Runtime For R

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution

9.4 CVSS 4.0 Critical EPSS 0.68% · top 48.8% CWE-94 · Code injection
9.4CVSS 4.0 base score
0.68%EPSS exploitation probability, 30 days
NoNot in CISA KEV
6Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3115-r3485/

Track CVE-2025-3115 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2017-3181Tibco spotfire analyst sql injection vulnerabilityMultiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input bef…EPSS 1.7%9.8CVE-2018-5435Tibco spotfire analyst vulnerabilityThe TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics P…EPSS 3.2%8.8CVE-2018-5437Tibco spotfire analyst vulnerabilityThe TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics P…EPSS 0.93%8.4CVE-2022-30579Tibco spotfire analytics platform server-side request forgery (ssrf) vulnerabilityThe Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficul…EPSS 0.59%8.0CVE-2019-17334Tibco spotfire analyst incorrect default permissions vulnerabilityThe Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire D…EPSS 0.96%7.8CVE-2021-23275Tibco enterprise runtime for r incorrect permission assignment vulnerabilityThe Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server …EPSS 0.22%7.8CVE-2021-28830Tibco enterprise runtime for r vulnerabilityThe TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIB…EPSS 0.25%7.5CVE-2015-4554Tibco spotfire deployment kit vulnerabilityMultiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before 6.0.3, 6.…EPSS 3.5%

Source: NIST National Vulnerability Database (record CVE-2025-3115), CISA KEV, FIRST EPSS (scores of 2026-10-11). This page is refreshed as NVD updates the record.