CVE-2025-40592: Siemens Mendix Studio Pro 10, обхождане на път

Описание

Оригинално описание

A vulnerability has been identified in Mendix Studio Pro 10 (All versions < V10.24.24 for Windows), Mendix Studio Pro 10 (All versions < V10.24.24 for Mac), Mendix Studio Pro 11 (All versions < V11.13.0 for Windows), Mendix Studio Pro 11 (All versions < V11.13.0 for Mac), Mendix Studio Pro 11.12 (All versions < V11.12.2 for Windows), Mendix Studio Pro 11.12 (All versions < V11.12.2 for Mac), Mendix Studio Pro 11.6 (All versions < V11.6.9 for Windows), Mendix Studio Pro 11.6 (All versions < V11.6.9 for Mac), Mendix Studio Pro 9 (All versions < V9.24.44 for Windows). A zip path traversal vulnerability exists in the module installation process of Studio Pro. By crafting a malicious module and distributing it via (for example) the Mendix Marketplace, an attacker could write or modify arbitrary files in directories outside a developer’s project directory upon module installation.

Засегнати продукти

• Siemens Mendix Studio Pro 10: преди V10.24.24
• Siemens Mendix Studio Pro 10: преди V10.24.24
• Siemens Mendix Studio Pro 11: преди V11.13.0
• Siemens Mendix Studio Pro 11: преди V11.13.0
• Siemens Mendix Studio Pro 11.12: преди V11.12.2
• Siemens Mendix Studio Pro 11.12: преди V11.12.2
• Siemens Mendix Studio Pro 11.6: преди V11.6.9
• Siemens Mendix Studio Pro 11.6: преди V11.6.9
• Siemens Mendix Studio Pro 9: преди V9.24.44

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория

История

Други уязвимости в Siemens Mendix Studio Pro 10

• 6.8CVE-2026-48192

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2025-40592
• https://nvd.nist.gov/vuln/detail/CVE-2025-40592
• https://cert-portal.siemens.com/productcert/html/ssa-627195.html