A path traversal flaw in the Factory Resource Management component of DELMIA Factory Resource Manager enables an attacker to read or write files in designated directories on the server. The vulnerability, identified as a CWE-22 weakness, could allow an adversary to exfiltrate sensitive data or modify configuration files, thereby compromising the confidentiality and integrity of the system. It does not directly lead to remote code execution, but the ability to alter files could facilitate subsequent attacks if malicious code is injected.

Dassault Systèmes DELMIA Factory Resource Manager versions released under 3DEXPERIENCE R2023x through R2025x are affected. Users of any of these releases should verify their environment for presence of the flaw.

The CVSS base score of 7.1 indicates a high severity, while an EPSS score of less than 1% suggests low current exploitation likelihood. The flaw is not listed in the CISA KEV catalog. Based on the component description, the likely attack vector is remote access via the software’s web interface; however, this is inferred rather than directly stated in the advisory.