CVE-2025-10551: ENOVIA Collaborative Stored XSS Vulnerability

CVE-2025-10551 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Document Management component of ENOVIA Collaborative Industry Innovator. This vulnerability affects versions from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x and allows an attacker to execute arbitrary script code within a user's browser session.

Stored XSS vulnerabilities are particularly dangerous because the malicious payload is persistently stored on the target server and automatically executed whenever a victim views the affected content. In the context of a document management system, this could lead to widespread compromise across an organization.

Critical Impact

An authenticated attacker can inject malicious scripts that execute in other users' browsers when they access affected documents, potentially leading to session hijacking, credential theft, and unauthorized actions within the 3DEXPERIENCE platform.

Affected Products

• ENOVIA Collaborative Industry Innovator Release 3DEXPERIENCE R2023x
• ENOVIA Collaborative Industry Innovator Release 3DEXPERIENCE R2024x
• ENOVIA Collaborative Industry Innovator Release 3DEXPERIENCE R2025x

Discovery Timeline

• 2026-03-31 - CVE-2025-10551 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-10551

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability (CWE-79) resides in the Document Management functionality of ENOVIA Collaborative Industry Innovator. The vulnerability allows attackers with low privileges to inject persistent malicious scripts that execute within the browser sessions of other users who view the affected content.

The attack requires user interaction—a victim must navigate to a page containing the stored malicious payload. However, once triggered, the scope of the attack can extend beyond the vulnerable component, potentially affecting other contexts within the user's session. This cross-scope impact enables attackers to compromise confidentiality and integrity of user data and sessions without directly affecting system availability.

Document management systems are particularly attractive targets for stored XSS attacks because documents are frequently shared and accessed by multiple users across an organization, providing natural amplification of the attack's reach.

Root Cause

The vulnerability stems from insufficient input validation and output encoding within the Document Management module. When user-supplied content is stored in the system and later rendered to other users, the application fails to properly sanitize the input or encode the output, allowing malicious JavaScript to be injected and executed.

This represents a classic stored XSS pattern where:

1. The attacker submits malicious script content through a document-related input field
2. The application stores this content without proper sanitization
3. When other users view the document or related content, the malicious script is rendered and executed in their browser context

Attack Vector

The attack vector is network-based, requiring low-privilege authentication to inject the malicious payload. The attacker exploits the document management functionality to store crafted input containing JavaScript code. Once stored, any user who views the affected document or content will have the script execute in their browser context with their session privileges.

Exploitation typically follows this pattern:

1. An authenticated attacker identifies input fields within Document Management that are rendered to other users
2. The attacker injects a payload containing malicious JavaScript (e.g., <script> tags, event handlers, or obfuscated script content)
3. The malicious content is stored in the application database
4. When a victim user views the affected content, the browser executes the injected script
5. The script can then steal session cookies, perform actions as the victim, or exfiltrate sensitive data

The vulnerability allows attackers to target high-privilege users, potentially escalating access within the 3DEXPERIENCE platform. For detailed technical information, refer to the 3DS Security Advisory.

Detection Methods for CVE-2025-10551

Indicators of Compromise

• Unusual JavaScript or HTML tags appearing in document metadata, titles, or content fields
• Web application firewall alerts detecting encoded or obfuscated script patterns in document-related requests
• User reports of unexpected browser behavior or pop-ups when accessing documents
• Session anomalies indicating possible session hijacking or credential theft

Detection Strategies

• Implement Content Security Policy (CSP) headers and monitor for CSP violation reports, which may indicate XSS exploitation attempts
• Configure web application firewalls to log and alert on common XSS payloads in POST requests to Document Management endpoints
• Review application logs for unusual patterns in document creation or modification, particularly content containing script tags or event handlers
• Deploy browser-based endpoint protection that can detect and block malicious script execution

Monitoring Recommendations

• Enable detailed logging for all Document Management operations including document creation, modification, and viewing events
• Monitor for outbound connections from user browsers to external domains that may indicate data exfiltration
• Track authentication events for signs of session hijacking following document access
• Implement real-time alerting for CSP violations within the 3DEXPERIENCE platform

How to Mitigate CVE-2025-10551

Immediate Actions Required

• Review the official 3DS Security Advisory for CVE-2025-10551 for specific patch information and guidance
• Apply available security updates from Dassault Systèmes to affected 3DEXPERIENCE platform installations
• Audit existing documents and content within the Document Management module for suspicious or malicious content
• Implement or strengthen Content Security Policy headers to restrict script execution sources
• Consider temporarily restricting document creation/modification permissions to trusted users until patches are applied

Patch Information

Organizations running ENOVIA Collaborative Industry Innovator versions R2023x through R2025x should consult the official 3DS Security Advisory for specific patch availability and installation instructions. Contact Dassault Systèmes support for assistance with patching production environments.

Workarounds

• Implement strict Content Security Policy (CSP) headers with script-src 'self' to prevent inline script execution
• Deploy web application firewall rules to block common XSS payloads in requests to Document Management endpoints
• Restrict document creation and editing permissions to vetted, trusted users until patches can be applied
• Enable additional input validation at the network perimeter level
• Consider isolating the 3DEXPERIENCE platform to trusted network segments

# Example CSP header configuration for Apache
# Add to httpd.conf or .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"