What is the CVSS score of CVE-2025-10559?

CVE-2025-10559 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Delmia Factory Resource Manager are affected by CVE-2025-10559?

DELMIA Factory Resource Manager (3DEXPERIENCE R2023x-R2025x) contains a path traversal vulnerability allowing authenticated users with low-privilege access to read and write files across the server,…

How to fix or mitigate CVE-2025-10559?

Within 24 hours: Inventory all 3DEXPERIENCE deployments and identify systems running DELMIA Factory Resource Manager in R2023x through R2025x versions; disable or restrict low-privilege user access to the Factory Resource Manager component pending remediation. Within 7 days: Review Dassault Systèmes security advisories for patch availability and test patches in non-production environments; implement network segmentation to limit Factory Resource Manager access to trusted administrative networks. Within 30 days: Deploy vendor patches immediately upon availability; if patches remain unavailable, implement application-layer access controls and file system permissions to restrict traversal scope; conduct audit of file access logs for evidence of exploitation.

Delmia Factory Resource Manager CVE-2025-10559

EUVD-2025-209135 HIGH

Path Traversal (CWE-22)

2026-03-31 3DS

GHSA-8pjm-jgvr-53w9

Path Traversal Delmia Factory Resource Manager

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 09:15 euvd

EUVD-2025-209135

Analysis Generated

Mar 31, 2026 - 09:15 vuln.today

CVE Published

Mar 31, 2026 - 08:41 nvd

HIGH 7.1

DescriptionCVE.org

A Path Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to read or write files in specific directories on the server.

AnalysisAI

Path traversal in DELMIA Factory Resource Manager (3DEXPERIENCE R2023x through R2025x) allows authenticated remote attackers to read sensitive files and write files to specific server directories. The vulnerability affects the Factory Resource Management component and requires low-privilege authentication (CVSS PR:L) with low attack complexity. EPSS data not available; no public exploit identified at time of analysis. This represents a significant data exposure risk in industrial manufacturing environments using Dassault Systèmes' 3DEXPERIENCE platform.

Technical ContextAI

DELMIA Factory Resource Manager is a component of Dassault Systèmes' 3DEXPERIENCE platform used for manufacturing resource planning and factory simulation. The vulnerability is a CWE-22 path traversal flaw, where insufficient input validation allows attackers to manipulate file paths using directory traversal sequences (e.g., '../') to access files outside intended directories. The affected CPE (cpe:2.3:a:dassault_systèmes:delmia_factory_resource_manager) indicates this is a server-side component accessible over the network. Path traversal vulnerabilities typically occur when user-supplied input is concatenated into file system operations without proper sanitization, canonicalization, or whitelist validation. In this case, the Factory Resource Management module fails to restrict file operations to safe directories, enabling both read and write access to server filesystem locations that should be protected.

RemediationAI

Apply vendor-released security updates from Dassault Systèmes as documented in their official security advisory at https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10559. The advisory should specify patched versions for each affected 3DEXPERIENCE release family (R2023x, R2024x, R2025x). Until patches can be deployed, implement network-level access controls to restrict Factory Resource Manager access to trusted users and IP ranges only. Review and audit user privilege assignments to ensure principle of least privilege, as the vulnerability requires authenticated access. Monitor file system access logs for unusual traversal patterns or access to sensitive directories. Consider disabling the Factory Resource Management component if not actively required for operations. Organizations should prioritize patching systems that handle proprietary manufacturing data or connect to production networks.