CVE-2026-48192 - Vulnerability Details

A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.13 (All versions), Mendix Studio Pro 10.14 (All versions), Mendix Studio Pro 10.15 (All versions), Mendix Studio Pro 10.16 (All versions), Mendix Studio Pro 10.17 (All versions), Mendix Studio Pro 10.18 (All versions), Mendix Studio Pro 10.19 (All versions), Mendix Studio Pro 10.20 (All versions), Mendix Studio Pro 10.21 (All versions), Mendix Studio Pro 10.22 (All versions), Mendix Studio Pro 10.23 (All versions), Mendix Studio Pro 10.24 (All versions < V10.24.21), Mendix Studio Pro 11.0 (All versions), Mendix Studio Pro 11.1 (All versions), Mendix Studio Pro 11.10 (All versions), Mendix Studio Pro 11.11 (All versions), Mendix Studio Pro 11.2 (All versions), Mendix Studio Pro 11.3 (All versions), Mendix Studio Pro 11.4 (All versions), Mendix Studio Pro 11.5 (All versions), Mendix Studio Pro 11.6 (All versions < V11.6.7), Mendix Studio Pro 11.7 (All versions), Mendix Studio Pro 11.8 (All versions), Mendix Studio Pro 11.9 (All versions). Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline. This could allow an attacker who tricks a user into opening and running a specially crafted malicious project locally on their system to execute arbitrary code in the context of that user.

Attack Vector Network

Attack Complexity High

Privileges Required High

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact High

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Siemens	Mendix Studio Pro 10.11 Mendix Studio Pro 10.12 Mendix Studio Pro 10.13 Mendix Studio Pro 10.14 Mendix Studio Pro 10.15 Mendix Studio Pro 10.16 Mendix Studio Pro 10.17 Mendix Studio Pro 10.18 Mendix Studio Pro 10.19 Mendix Studio Pro 10.20 Mendix Studio Pro 10.21 Mendix Studio Pro 10.22 Mendix Studio Pro 10.23 Mendix Studio Pro 10.24 Mendix Studio Pro 11.0 Mendix Studio Pro 11.1 Mendix Studio Pro 11.10 Mendix Studio Pro 11.11 Mendix Studio Pro 11.2 Mendix Studio Pro 11.3 Mendix Studio Pro 11.4 Mendix Studio Pro 11.5 Mendix Studio Pro 11.6 Mendix Studio Pro 11.7 Mendix Studio Pro 11.8 Mendix Studio Pro 11.9

No data.

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-779310.html

History

Wed, 01 Jul 2026 10:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Siemens Siemens mendix Studio Pro 10.11 Siemens mendix Studio Pro 10.12 Siemens mendix Studio Pro 10.13 Siemens mendix Studio Pro 10.14 Siemens mendix Studio Pro 10.15 Siemens mendix Studio Pro 10.16 Siemens mendix Studio Pro 10.17 Siemens mendix Studio Pro 10.18 Siemens mendix Studio Pro 10.19 Siemens mendix Studio Pro 10.20 Siemens mendix Studio Pro 10.21 Siemens mendix Studio Pro 10.22 Siemens mendix Studio Pro 10.23 Siemens mendix Studio Pro 10.24 Siemens mendix Studio Pro 11.0 Siemens mendix Studio Pro 11.1 Siemens mendix Studio Pro 11.10 Siemens mendix Studio Pro 11.11 Siemens mendix Studio Pro 11.2 Siemens mendix Studio Pro 11.3 Siemens mendix Studio Pro 11.4 Siemens mendix Studio Pro 11.5 Siemens mendix Studio Pro 11.6 Siemens mendix Studio Pro 11.7 Siemens mendix Studio Pro 11.8 Siemens mendix Studio Pro 11.9
Vendors & Products		Siemens Siemens mendix Studio Pro 10.11 Siemens mendix Studio Pro 10.12 Siemens mendix Studio Pro 10.13 Siemens mendix Studio Pro 10.14 Siemens mendix Studio Pro 10.15 Siemens mendix Studio Pro 10.16 Siemens mendix Studio Pro 10.17 Siemens mendix Studio Pro 10.18 Siemens mendix Studio Pro 10.19 Siemens mendix Studio Pro 10.20 Siemens mendix Studio Pro 10.21 Siemens mendix Studio Pro 10.22 Siemens mendix Studio Pro 10.23 Siemens mendix Studio Pro 10.24 Siemens mendix Studio Pro 11.0 Siemens mendix Studio Pro 11.1 Siemens mendix Studio Pro 11.10 Siemens mendix Studio Pro 11.11 Siemens mendix Studio Pro 11.2 Siemens mendix Studio Pro 11.3 Siemens mendix Studio Pro 11.4 Siemens mendix Studio Pro 11.5 Siemens mendix Studio Pro 11.6 Siemens mendix Studio Pro 11.7 Siemens mendix Studio Pro 11.8 Siemens mendix Studio Pro 11.9

Tue, 30 Jun 2026 16:45:00 +0000

Type	Values Removed	Values Added
Title		Local Code Execution via Unsanitized Project Files in Mendix Studio Pro

Tue, 30 Jun 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 30 Jun 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.13 (All versions), Mendix Studio Pro 10.14 (All versions), Mendix Studio Pro 10.15 (All versions), Mendix Studio Pro 10.16 (All versions), Mendix Studio Pro 10.17 (All versions), Mendix Studio Pro 10.18 (All versions), Mendix Studio Pro 10.19 (All versions), Mendix Studio Pro 10.20 (All versions), Mendix Studio Pro 10.21 (All versions), Mendix Studio Pro 10.22 (All versions), Mendix Studio Pro 10.23 (All versions), Mendix Studio Pro 10.24 (All versions < V10.24.21), Mendix Studio Pro 11.0 (All versions), Mendix Studio Pro 11.1 (All versions), Mendix Studio Pro 11.10 (All versions), Mendix Studio Pro 11.11 (All versions), Mendix Studio Pro 11.2 (All versions), Mendix Studio Pro 11.3 (All versions), Mendix Studio Pro 11.4 (All versions), Mendix Studio Pro 11.5 (All versions), Mendix Studio Pro 11.6 (All versions < V11.6.7), Mendix Studio Pro 11.7 (All versions), Mendix Studio Pro 11.8 (All versions), Mendix Studio Pro 11.9 (All versions). Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline. This could allow an attacker who tricks a user into opening and running a specially crafted malicious project locally on their system to execute arbitrary code in the context of that user.
Weaknesses		CWE-94
References		https://cert-portal.siemens.com/productcert/html/ssa-779310.html
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N'}` cvssV4_0 `{'score': 6.8, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: siemens

Published: 2026-06-30T14:30:59.828Z

Updated: 2026-06-30T15:05:37.197Z

Reserved: 2026-05-21T08:13:02.100Z

Link: CVE-2026-48192

Vulnrichment

Updated: 2026-06-30T15:05:33.355Z

NVD

No data.

Redhat

No data.

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required High

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact High

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object