CVE-2025-10559

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A Path Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to read or write files in specific directories on the server.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Dassault Systèmes	DELMIA Factory Resource Manager	>= Release 3DEXPERIENCE R2023x Golden, <= Release 3DEXPERIENCE R2023x.FP.CFA.2541; >= Release 3DEXPERIENCE R2024x Golden, <= Release 3DEXPERIENCE R2024x.FP.CFA.2537; >= Release 3DEXPERIENCE R2025x Golden, <= Release 3DEXPERIENCE R2025x.FP.CFA.2514

References

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10559Vendor Advisory

Timeline

Published: Mar 31, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-10566.5Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A n CVE-2025-105609.3Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application b CVE-2025-105629.8A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. This affects an unknown function of the file /ajax.php?action=sav CVE-2025-105639.8A vulnerability has been found in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?a CVE-2025-105649.8A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=CVE-2025-105659.8A vulnerability was determined in Campcodes Grocery Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionali CVE-2025-105666.1A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of CVE-2025-105676.3The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX act CVE-2025-105689.8HyperX NGENUITY software is potentially vulnerable to arbitrary code execution. HP is releasing updated software to address the potential vu CVE-2025-105696.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 tha CVE-2025-10574.3A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar f CVE-2025-105704.3The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and