CVE-2026-10094 Overview
CVE-2026-10094 is a path traversal vulnerability in SOLIDWORKS Visualize, affecting SOLIDWORKS Desktop Release 2024 through SOLIDWORKS Desktop Release 2026. The flaw allows a remote, unauthenticated attacker to write arbitrary files on the server by manipulating file path inputs. The weakness maps to [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).
Dassault Systèmes published the advisory on June 17, 2026. The vulnerability is network-exploitable with low attack complexity and requires no user interaction. Successful exploitation can lead to remote code execution, data tampering, or service disruption through arbitrary file placement.
Critical Impact
Unauthenticated attackers can write arbitrary files to the underlying server, enabling code execution, configuration tampering, and complete compromise of SOLIDWORKS Visualize installations.
Affected Products
- SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024
- SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2025
- SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2026
Discovery Timeline
- 2026-06-17 - CVE CVE-2026-10094 assigned and published to NVD
- 2026-06-17 - Dassault Systèmes publishes security advisory
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-10094
Vulnerability Analysis
The vulnerability resides in how SOLIDWORKS Visualize processes file path inputs supplied by remote clients. The application fails to canonicalize and validate user-supplied path components before using them in file write operations. An attacker can supply directory traversal sequences such as ../ to escape the intended working directory and write files to arbitrary locations on disk.
Because the flaw is reachable over the network without authentication, an attacker only needs to deliver a crafted request or file containing a manipulated path. The write primitive allows attackers to drop executables into autorun locations, overwrite configuration files, or replace trusted binaries used by the SOLIDWORKS process.
Root Cause
The root cause is improper neutralization of pathname elements in file-handling routines. The affected code paths concatenate or use attacker-controlled filename components without enforcing a canonical base directory check. Traversal sequences and absolute paths are not stripped or rejected before the write operation reaches the filesystem.
Attack Vector
An attacker exploits this flaw remotely by sending crafted input containing path traversal sequences to a network-exposed SOLIDWORKS Visualize service or by inducing the application to process a malicious project file. The write operation executes with the privileges of the SOLIDWORKS process, which on workstation deployments typically runs in the user context. Where SOLIDWORKS Visualize is deployed on shared infrastructure, the impact extends to the host server.
No proof-of-concept code is currently published. Refer to the 3DS Security Advisory CVE-2026-10094 for vendor-supplied technical details.
Detection Methods for CVE-2026-10094
Indicators of Compromise
- Unexpected files written to SOLIDWORKS Visualize installation directories, Startup folders, or scheduled task paths
- Filesystem audit events showing the SOLIDWORKS Visualize process writing outside its expected working directory
- Project files or network payloads containing ../, ..\, or URL-encoded traversal sequences (%2e%2e%2f)
- Modification timestamps on .exe, .dll, or configuration files coinciding with Visualize sessions
Detection Strategies
- Monitor file creation events from the SOLIDWORKS Visualize process and alert on writes outside approved directories
- Inspect inbound project files and network traffic for path traversal patterns before they reach Visualize
- Correlate filesystem changes in autorun and service paths with active Visualize process IDs
Monitoring Recommendations
- Enable filesystem and process auditing on hosts running SOLIDWORKS Visualize 2024 through 2026
- Forward endpoint telemetry to a centralized analytics platform for cross-host correlation
- Baseline normal Visualize file write behavior and alert on deviations such as writes to system directories
How to Mitigate CVE-2026-10094
Immediate Actions Required
- Apply the Dassault Systèmes patch for SOLIDWORKS Visualize as specified in the vendor advisory
- Inventory all SOLIDWORKS Desktop 2024, 2025, and 2026 installations and prioritize internet-exposed hosts
- Restrict network access to SOLIDWORKS Visualize services using host-based firewalls and network segmentation
- Treat project files from untrusted sources as malicious until the patch is applied
Patch Information
Dassault Systèmes has published remediation guidance in the 3DS Security Advisory CVE-2026-10094. Administrators should review the advisory for fixed builds and apply updates through the standard SOLIDWORKS update channels.
Workarounds
- Block inbound network access to SOLIDWORKS Visualize endpoints from untrusted networks until patching completes
- Run SOLIDWORKS Visualize under a least-privilege user account to limit the scope of arbitrary file writes
- Disable processing of project files received from external sources and validate origin before opening
- Apply application allowlisting to prevent execution of unexpected binaries dropped into writable paths
# Configuration example: restrict Visualize host inbound access on Windows
New-NetFirewallRule -DisplayName "Block-Visualize-Inbound" -Direction Inbound -Program "C:\Program Files\SOLIDWORKS Corp\SOLIDWORKS Visualize\sldVisualize.exe" -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
