CVE-2025-3115 is a Critical severity (CVSS 9.8) code injection flaw in several TIBCO Spotfire products. The record describes injection in some functions and weak filename validation on file uploads. It does not list fixed versions, so read the Spotfire advisory of 8 April 2025 and apply the update it names.
What's affected
The record names six Spotfire products as affected: Spotfire Analyst, Spotfire Analytics Platform, Spotfire Deployment Kit, Spotfire Desktop, Spotfire Enterprise Runtime for R and Spotfire Statistics Services. The vendor is TIBCO.
The NVD description has two parts. First, injection vulnerabilities: attackers can inject malicious code, potentially gaining control of the system that executes certain functions. Second, insufficient validation of filenames during file uploads can let an attacker upload and run malicious files, leading to arbitrary code execution.
The weakness is CWE-94, improper control of code generation. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, no privileges and no user interaction. The record does not mark the CVE as in CISA KEV.
The record does not give version ranges or fixed versions, and the vendor advisory page could not be read in full when this post was prepared. Treat every installed version of these products as in scope until the vendor advisory tells you otherwise.
How to check if you're exposed
Start with an inventory. Spotfire installs show up in several places: analyst desktops, a Spotfire Server, statistics services hosts and R runtime hosts. On Windows, list installed TIBCO software:
Get-Package | Where-Object { $_.Name -like "*Spotfire*" } | Select-Object Name, Version
For server components, read the version from the installed product's About dialog or from your deployment records.
Then compare against the vendor's advisory. Open the TIBCO Spotfire security advisory dated April 8, 2025 (reference r3485 in its address) and look for the affected version table and the hotfix or release that fixes each product line. If the advisory page requires a community login, use the account tied to your support entitlement.
Also check exposure. Is Statistics Services or the Spotfire Server reachable from outside your network? Who can upload files to it? Those two answers decide how urgent this is for you.
What to do now
- Inventory every Spotfire component, including desktop clients and R runtime hosts.
- Open the vendor advisory and apply the fixed release or hotfix it lists for each product line.
- Until you have patched, restrict network access to Spotfire Server and Statistics Services to the users who need it, and remove any internet exposure.
- Review who can upload files or run custom code through the platform and remove access that is not needed.
- Check server logs for unusual uploads or unexpected processes started by the Spotfire service account, and escalate anything odd to your incident process.
Why it matters
This is a code injection flaw, and the advisory text pairs it with weak validation of uploaded filenames. Both lead to the same bad outcome: input from an outsider ends up controlling what the server executes. The weakness class, CWE-94, is among the most serious because it can give an attacker control of the host with the permissions of the service account.
Analytics platforms are interesting targets because they connect to data warehouses and hold stored credentials for them. A compromised analytics server can become a bridge to the data behind it. For this reason, treat the data source credentials stored in Spotfire as in scope if you suspect abuse, and rotate them as part of the response.
Quick check
Do I know which versions are fixed?
Not from the record. It lists the affected products but no versions. The Spotfire advisory is the authority, so follow its table.
Is this exploited in the wild?
The record does not mark it as in CISA KEV, and this post found no vendor statement of exploitation. That can change, so check the advisory and KEV before you decide on urgency.
Sources
- TIBCO Spotfire security advisory April 08 2025 (CVE-2025-3115)
- Safeguard Gold page for CVE-2025-3115
Last reviewed: 19 October 2026.
