Skip to content
Fencer Intel
critical 9.8

CVE-2025-3115 json

Spotfire Data Function Vulnerability

published last yr. modified 4mo ago also EUVD-2025-10552

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution

Patch / fix

  • Spotfire Spotfire Statistics Services 14.0.7
  • Spotfire Spotfire Analyst 14.0.6
  • Spotfire Deployment Kit used in Spotfire Server 14.0.7
  • Spotfire Spotfire Desktop 14.4.2
  • Spotfire Spotfire Enterprise Runtime for R - Server Edition 1.17.7
  • Spotfire Spotfire Service for Python 1.17.7
  • Spotfire Spotfire Service for R 1.17.7

Is CVE-2025-3115 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 4.0 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA 4.0 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Spotfire Spotfire Statistics Services
  • Spotfire Spotfire Analyst
  • Spotfire Deployment Kit used in Spotfire Server
  • Spotfire Spotfire Desktop
  • Spotfire Spotfire for AWS Marketplace
  • Spotfire Spotfire Enterprise Runtime for R - Server Edition
  • Spotfire Spotfire Service for Python
  • Spotfire Spotfire Service for R

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.