Overview
CVE-2025-4991 is a stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in the Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x. XSS vulnerabilities are a class of security flaws that can allow an attacker to inject malicious scripts into webpages viewed by other users, potentially leading to significant data breaches or system compromises.
This particular vulnerability matters because it can allow an attacker to execute arbitrary script code in a user’s browser session. The Collaborative Industry Innovator is widely used in the manufacturing and design industries, meaning that businesses in these sectors could be at risk of data leakage or system compromise if they are running affected versions of the software.
Vulnerability Summary
CVE ID: CVE-2025-4991
Severity: High (8.7 CVSS)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: System compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Collaborative Industry Innovator | 3DEXPERIENCE R2022x – R2025x
How the Exploit Works
A stored XSS vulnerability like CVE-2025-4991 allows an attacker to inject malicious script into a webpage that then gets stored on the server. Whenever another user visits that webpage, the script is served up along with the rest of the webpage content and is executed in the user’s browser session. This can allow the attacker to steal sensitive information, impersonate the user, or perform actions on the user’s behalf.
Conceptual Example Code
Here’s a conceptual example of how the vulnerability may be exploited. This is a sample HTTP POST request that injects a malicious script into a vulnerable endpoint.
POST /vulnerable/endpoint HTTP/1.1
Host: target.example.com
Content-Type: application/json
{
"markup_data": "<script>malicious_code_here</script>"
}In this example, the `markup_data` field, which is meant to contain benign markup data, is instead used to inject a malicious script. When this data is later served up to another user, the script will be executed in their browser.
Mitigation
The primary mitigation for this vulnerability is to apply the vendor’s patch. If this is not immediately feasible, using a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can offer temporary mitigation by blocking or alerting on attempts to exploit the vulnerability.
However, these are only temporary solutions and do not address the underlying issue. It is strongly recommended to apply the vendor’s patch as soon as possible to fully mitigate this vulnerability.