CVE-2025-10559: DELMIA Path Traversal Vulnerability

CVE-2025-10559 Overview

A Path Traversal vulnerability has been identified in the Factory Resource Management component of DELMIA Factory Resource Manager. This vulnerability affects multiple releases spanning from 3DEXPERIENCE R2023x through 3DEXPERIENCE R2025x. The flaw allows an attacker with low-level privileges to read or write files in specific directories on the server through network-based exploitation.

Critical Impact

Authenticated attackers can exploit this path traversal vulnerability to access sensitive files or write malicious content to restricted server directories, potentially leading to data exfiltration or system compromise.

Affected Products

• DELMIA Factory Resource Manager Release 3DEXPERIENCE R2023x
• DELMIA Factory Resource Manager Release 3DEXPERIENCE R2024x
• DELMIA Factory Resource Manager Release 3DEXPERIENCE R2025x

Discovery Timeline

• 2026-03-31 - CVE CVE-2025-10559 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-10559

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), a weakness category that occurs when software uses external input to construct a pathname that should be restricted to a specific directory, but fails to properly neutralize special elements that can cause the pathname to resolve outside of that directory.

In the case of CVE-2025-10559, the Factory Resource Management component of DELMIA Factory Resource Manager does not adequately validate user-supplied file path inputs. This allows an authenticated attacker to craft specially formatted requests containing path traversal sequences (such as ../ or equivalent encoded variants) to escape the intended directory boundary and access files in other locations on the server.

The impact includes both read and write capabilities to specific server directories, meaning attackers could potentially exfiltrate sensitive configuration data, application secrets, or business-critical files. Additionally, the write capability could enable attackers to upload malicious files or modify existing configurations to establish persistence or escalate privileges.

Root Cause

The root cause of this vulnerability lies in improper input validation and sanitization of file path parameters within the Factory Resource Management functionality. The application fails to properly neutralize special elements such as ../, ..\\, URL-encoded sequences, or double-encoding variants before constructing file paths for server-side file operations.

When user-controlled input is concatenated directly with a base directory path without adequate validation, attackers can manipulate the final path to point outside the intended directory structure. This allows traversal to parent directories and potentially access to sensitive areas of the file system.

Attack Vector

The attack is conducted over the network and requires low-level authentication to exploit. No user interaction is needed for successful exploitation. An attacker would typically:

1. Authenticate to the DELMIA Factory Resource Manager application with valid credentials
2. Identify API endpoints or functionality that accepts file path parameters
3. Inject path traversal sequences to manipulate the file path
4. Read sensitive files or write malicious content to restricted directories

The vulnerability allows for unauthorized file read operations that could expose sensitive configuration files, credentials, or application data. The write capability could be leveraged to modify application configurations, plant backdoors, or overwrite critical system files within accessible directories.

Detection Methods for CVE-2025-10559

Indicators of Compromise

• HTTP requests containing path traversal sequences such as ../, ..\\, %2e%2e%2f, or %2e%2e/ in file path parameters
• Unexpected file access patterns in web server or application logs indicating reads from parent directories
• Modification of files outside the expected application directories
• Access to sensitive configuration files such as /etc/passwd, application configuration files, or database connection strings
• Anomalous authenticated user sessions making repeated file access requests

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
• Implement file integrity monitoring on critical server directories to detect unauthorized modifications
• Enable detailed application logging for all file system operations and monitor for suspicious path access patterns
• Configure intrusion detection systems (IDS) with signatures for common path traversal attack patterns

Monitoring Recommendations

• Monitor application logs for requests containing encoded path traversal sequences
• Track file access events on the DELMIA server for operations outside of designated resource directories
• Alert on repeated failed file access attempts followed by successful reads/writes to sensitive paths
• Review authentication logs for anomalous session behavior from users attempting exploitation

How to Mitigate CVE-2025-10559

Immediate Actions Required

• Review and apply security patches from Dassault Systèmes for affected DELMIA Factory Resource Manager releases
• Implement network segmentation to restrict access to DELMIA servers from untrusted network segments
• Audit user accounts with access to the Factory Resource Management functionality and apply least-privilege principles
• Deploy WAF rules to block path traversal attack patterns while awaiting patch deployment
• Enable enhanced logging and monitoring on affected systems to detect exploitation attempts

Patch Information

Dassault Systèmes has released security guidance for this vulnerability. Administrators should consult the 3DS Security Advisory for CVE-2025-10559 for detailed patch information and update instructions for DELMIA Factory Resource Manager versions R2023x through R2025x.

Workarounds

• Implement strict input validation at the application layer to reject any file path containing traversal sequences
• Configure web server or reverse proxy to filter requests containing ../, encoded variants, or other path manipulation characters
• Restrict file system permissions on the server to limit the directories accessible to the application service account
• Consider implementing application-level sandboxing to confine file operations to specific allowed directories
• Use network access controls to limit which users and systems can reach the vulnerable functionality