GEOVIA Geospatial Data Manager versions from Release 3DEXPERIENCE R2024x through R2026x contain a code injection flaw that permits an attacker to run arbitrary code on the underlying server. The vulnerability is characterized by CWE-94 and can lead to full compromise of the system, exposing sensitive geospatial data and enabling persistence or lateral movement. Exploitation would allow an attacker to download files, modify configuration, or execute any commands available to the application process.

Dassault Systèmes GEOVIA Geospatial Data Manager, releases 3DEXPERIENCE R2024x to R2026x, are directly impacted. No other versions or product lines were reported as affected.

The CVSS score of 9.9 indicates critical severity, and the EPSS score is not publicly available, so the likelihood of exploitation cannot be quantified precisely. The vulnerability is not listed in the CISA KEV catalog, but given the high severity and potential for arbitrary code execution, the risk remains substantial. Attackers would likely exploit the flaw over a network interface such as a web port or API, requiring authentication or not depending on the exposed services; the exact path is not disclosed in the advisory and would be inferred from typical GEOVIA usage patterns.