Vulnerability · Published Jun 12, 2025 · Assigned by siemens
CVE-2025-40592
Medium 6.1
In plain English
A medium-severity path traversal in Mendix Studio Pro 10 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
A vulnerability has been identified in Mendix Studio Pro 10 (All versions < V10.24.24 for Windows), Mendix Studio Pro 10 (All versions < V10.24.24 for Mac), Mendix Studio Pro 11 (All versions < V11.13.0 for Windows), Mendix Studio Pro 11 (All versions < V11.13.0 for Mac), Mendix Studio Pro 11.12 (All versions < V11.12.2 for Windows), Mendix Studio Pro 11.12 (All versions < V11.12.2 for Mac), Mendix Studio Pro 11.6 (All versions < V11.6.9 for Windows), Mendix Studio Pro 11.6 (All versions < V11.6.9 for Mac), Mendix Studio Pro 9 (All versions < V9.24.44 for Windows). A zip path traversal vulnerability exists in the module installation process of Studio Pro. By crafting a malicious module and distributing it via (for example) the Mendix Marketplace, an attacker could write or modify arbitrary files in directories outside a developer’s project directory upon module installation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Mendix Studio Pro 10 | 0 – before V10.24.24 |
| Siemens | Mendix Studio Pro 10 | 0 – before V10.24.24 |
| Siemens | Mendix Studio Pro 11 | 0 – before V11.13.0 |
| Siemens | Mendix Studio Pro 11 | 0 – before V11.13.0 |
| Siemens | Mendix Studio Pro 11.12 | 0 – before V11.12.2 |
| Siemens | Mendix Studio Pro 11.12 | 0 – before V11.12.2 |
| Siemens | Mendix Studio Pro 11.6 | 0 – before V11.6.9 |
| Siemens | Mendix Studio Pro 11.6 | 0 – before V11.6.9 |
| Siemens | Mendix Studio Pro 9 | 0 – before V9.24.44 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N