PT-2025-15838 · Tibco · Tibco Spotfire

Published 2025-04-09 · Updated 2025-11-11 · CVE-2025-3115

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache File Upload versions (affected versions not specified) TIBCO Spotfire versions (affected versions not specified)

Description: The issue allows attackers to inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution.

Recommendations: For Apache File Upload, restrict access to the file upload functionality until a patch is available. For TIBCO Spotfire, consider disabling the affected functions or modules to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-3115

Affected Products

Tibco Spotfire

References · 21

• https://osv.dev/vulnerability/CVE-2025-3115 · Vendor Advisory
• https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3114-r3484 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3115 · Security Note
• https://t.me/cvetracker/21244 · Telegram Post
• https://twitter.com/syedaquib77/status/1910695082295959694 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1910511259851907221 · Twitter Post
• https://twitter.com/CCBalert/status/1910378870219419770 · Twitter Post
• https://t.me/cveNotify/142400 · Telegram Post
• https://t.me/purp_sec/499 · Telegram Post
• https://t.me/pentestingnews/59387 · Telegram Post
• https://twitter.com/AnonOzzyDude/status/1988226545375236317 · Twitter Post
• https://t.me/cvedetector/22569 · Telegram Post
• https://twitter.com/zoomeye_team/status/1911033440818122765 · Twitter Post
• https://t.me/cvenotify/119405 · Telegram Post
• https://twitter.com/Dinosn/status/1910539461630304674 · Twitter Post