CVE-2025-40592

MediumCVSS 6.1

Published: 12/06/2025(UTC)Updated: 28/09/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

A zip path traversal vulnerability exists in the module installation process of Mendix Studio Pro 9, 10, 11 and 11.12 (Windows and Mac versions). By crafting a malicious module and distributing it via the Mendix Marketplace, an attacker could write or modify arbitrary files outside a developer's project directory.

Risk Assessment

The organization may be compromised through injection of malicious code or modification of project files, potentially leading to takeover of the development environment or injection of backdoors into applications.

Recommendation

Immediately update Mendix Studio Pro to the versions specified in the description (e.g., V10.24.24, V11.13.0, V11.12.2, V11.6.9, V9.24.44) and avoid installing modules from unverified sources.

Other vulnerabilities in Mendix Studio Pro

CVE-2026-48192Medium
A vulnerability in Mendix Studio Pro arises from improper validation and sanitization of project files processed during the build pipeline. An attacker can trick a user into opening and running a specially crafted malicious project, leading to arbitrary code execution in the context of that user.

Original NVD description (English source)

A vulnerability has been identified in Mendix Studio Pro 10 (All versions < V10.24.24 for Windows), Mendix Studio Pro 10 (All versions < V10.24.24 for Mac), Mendix Studio Pro 11 (All versions < V11.13.0 for Windows), Mendix Studio Pro 11 (All versions < V11.13.0 for Mac), Mendix Studio Pro 11.12 (All versions < V11.12.2 for Windows), Mendix Studio Pro 11.12 (All versions < V11.12.2 for Mac), Mendix Studio Pro 11.6 (All versions < V11.6.9 for Windows), Mendix Studio Pro 11.6 (All versions < V11.6.9 for Mac), Mendix Studio Pro 9 (All versions < V9.24.44 for Windows). A zip path traversal vulnerability exists in the module installation process of Studio Pro. By crafting a malicious module and distributing it via (for example) the Mendix Marketplace, an attacker could write or modify arbitrary files in directories outside a developer’s project directory upon module installation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS