Vulnerability record · CVE-2014-100015 · published 13 January 2015
CVE-2014-100015: SolidWorks Workgroup PDM directory traversal in file upload
Solidworks · Product Data Management
SolidWorks Workgroup PDM 2014 contains a directory traversal flaw in pdmwService.exe: a filename in a file upload can include .. (dot dot) sequences. Because the service writes uploaded files to paths derived from that filename, an unauthenticated remote attacker can place files outside the intended upload directory. This matters because arbitrary file writes on a PDM server can corrupt data or plant content that other components later execute or trust.
Description
Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files via a .. (dot dot) in the filename in a file upload.
AV:N/AC:L/Au:N/C:N/I:P/A:P
Automated analysis
high priorityUnauthenticated remote arbitrary file write with public exploit code and very high EPSS, though the CVSS 2.0 base score is only 6.4 and the product is an older, likely limited-deployment PDM server.
What it is
SolidWorks Workgroup PDM 2014 contains a directory traversal flaw in pdmwService.exe: a filename in a file upload can include .. (dot dot) sequences. Because the service writes uploaded files to paths derived from that filename, an unauthenticated remote attacker can place files outside the intended upload directory. This matters because arbitrary file writes on a PDM server can corrupt data or plant content that other components later execute or trust.
Impact
An attacker gains the ability to write arbitrary files to locations writable by the pdmwService.exe process on the server. Depending on what is writable and how the service is deployed, this can lead to data tampering or code execution through planted files.
Attack surface
The flaw is reachable over the network through the PDM file upload interface on pdmwService.exe, per the AV:N vector. The CVSS vector shows Au:N and no user interaction, so no authentication or victim action is required.
Exploitation
Public exploit code exists, with Exploit-DB and Packet Storm references tagged Exploit. The CVE is not in CISA KEV, but EPSS is high at roughly 0.57 probability (99th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Apply the SolidWorks/Dassault Systèmes fix for Workgroup PDM 2014 if still supported; if no patch is available, retire or isolate the product.
- Restrict network access to pdmwService.exe and the PDM upload interface to trusted hosts only.
- Run the PDM service under a low-privilege account with write access limited to the intended upload directory.
- Sanitize and canonicalize uploaded filenames, rejecting .. sequences and absolute paths, if any custom front end is in use.
- Monitor and alert on unexpected file creation outside the PDM data directories.
Detection
- Audit file creation and modification events on the PDM server for paths outside the expected upload and data directories.
- Inspect PDM upload logs or network traffic for filenames containing .. or path separators.
- Alert on new executable or script files appearing in web-accessible or service-loaded directories on the PDM host.
- Correlate pdmwService.exe process file writes with known-good upload destinations to flag anomalies.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-100015 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-100015), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
