CVE-2025-40592
Description
A vulnerability has been identified in Mendix Studio Pro 10 (All versions < V10.24.24 for Windows), Mendix Studio Pro 10 (All versions < V10.24.24 for Mac), Mendix Studio Pro 11 (All versions < V11.13.0 for Windows), Mendix Studio Pro 11 (All versions < V11.13.0 for Mac), Mendix Studio Pro 11.12 (All versions < V11.12.2 for Windows), Mendix Studio Pro 11.12 (All versions < V11.12.2 for Mac), Mendix Studio Pro 11.6 (All versions < V11.6.9 for Windows), Mendix Studio Pro 11.6 (All versions < V11.6.9 for Mac), Mendix Studio Pro 9 (All versions < V9.24.44 for Windows). A zip path traversal vulnerability exists in the module installation process of Studio Pro. By crafting a malicious module and distributing it via (for example) the Mendix Marketplace, an attacker could write or modify arbitrary files in directories outside a developer’s project directory upon module installation.
How to fix
- Siemens Mendix Studio Pro 10V10.24.24 or later
- Siemens Mendix Studio Pro 11V11.13.0 or later
- Siemens Mendix Studio Pro 11.12V11.12.2 or later
- Siemens Mendix Studio Pro 11.6V11.6.9 or later
- Siemens Mendix Studio Pro 9V9.24.44 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens Mendix Studio Pro 10 | v < V10.24.24 | V10.24.24 |
| Siemens Mendix Studio Pro 11 | v < V11.13.0 | V11.13.0 |
| Siemens Mendix Studio Pro 11.12 | v < V11.12.2 | V11.12.2 |
| Siemens Mendix Studio Pro 11.6 | v < V11.6.9 | V11.6.9 |
| Siemens Mendix Studio Pro 9 | v < V9.24.44 | V9.24.44 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.