CVE-2025-10559 is a high severity (7.1) path traversal in DELMIA Factory Resource Manager, from 3DEXPERIENCE R2023x through R2025x. An authenticated attacker can read or write files in specific server directories. The advisory points to a remediation article, so apply the fix it describes.
What's affected
Dassault Systemes lists DELMIA Factory Resource Manager from 3DEXPERIENCE Release R2023x through Release R2025x. The advisory page names no fixed release in the text. It links a remediation article numbered QA00000430178 in the 3DS support knowledge base, which should carry the patch or hotfix details.
The CVSS vector is AV:N/AC:L/PR:L/UI:N, so a low privileged login is required. Confidentiality impact is high and integrity impact is low.
How to check if you're exposed
Check your 3DEXPERIENCE platform.
- Find your release level, R2023x, R2024x or R2025x, in the platform administration pages or from your Dassault support records.
- Confirm whether Factory Resource Management is deployed and in use.
- Log in to the 3DS support site and open the remediation article named in the advisory to see the required hotfix level.
- Review access to the server file system areas that the application can read and write.
What to do now
- Confirm whether DELMIA Factory Resource Manager runs in your 3DEXPERIENCE estate.
- Open the 3DS security advisory and the linked remediation article, and apply the hotfix or update they name.
- Reduce the set of users who hold accounts able to reach Factory Resource Management.
- Run the application service with the least file system rights it needs.
- Review file changes in the application directories for anything unexpected.
Why it matters
The weakness is CWE-22, path traversal. The application builds a file location from request data. If it does not confine the result to an intended directory, a caller can reach files outside it. Here the record says files can be read or written in specific directories.
Because a login is needed, the main risk comes from a low privileged or stolen account. Manufacturing planning systems hold production data that competitors value, so control of read and write access to server files deserves attention even at a 7.1 score.
Quick check
Does the advisory name a fixed version?
Not in the page text. It links a remediation article, QA00000430178, which should give the patch details.
Sources
Last reviewed: 19 October 2026.
