DELMIA Apriso - Command Injection
CVE-2025-6204
Verified
Description
An Improper Control of Generation of Code (code injection / file upload → RCE) vulnerability affecting DELMIA Apriso (Release 2020 → Release 2025). When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place executable artifacts into web-served locations (via path traversal or insufficient normalization) and achieve remote code execution under the webserver context.
Severity
Critical
CVSS Score
9
Exploit Probability
78%
Published Date
September 23, 2025
Template Author
iamnoooob, rootxharsh, parthmalhotra
+1
CVE-2025-6204.yaml
9.0Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2025-6204
CWE ID:
cwe-94
Remediation Steps
Apply security patches from DELMIA for Release 2020 through Release 2025 to implement proper file upload validation and path canonicalization.