Skip to content

TAN-2026-082

Tanium addressed a path traversal vulnerability in Tanium Data Service.

Severity: Medium

Base Score: 5.0

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L

Impact

This vulnerability could allow an authenticated Tanium user with the "Result Expansion Write" permission to write files to arbitrary directories on the Tanium Module Server.

Products Affected

2025H1 Release:

  • Interact prior to Update 26 (v3.5.0 to v3.5.141)

2025H2 Release:

  • Tanium Data Service prior to Update 16 (v4.1 to v4.1.281)

2026H1 Release:

  • Tanium Data Service prior to Update 9 (v4.2 to v4.2.360)

Available Updates

2025H1 Release:

  • Update 26 (Interact v3.5.141) and later

2025H2 Release:

  • Update 16 (Tanium Data Service v4.1.281) and later

2026H1 Release:

  • Update 9 (Tanium Data Service v4.2.360) and later

Workaround and Mitigations

None.

Acknowledgements

None.