Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities by joniles
CVE-2026-65829 (GCVE-0-2026-65829)
Vulnerability from nvd – Published: 2026-09-22 19:54 – Updated: 2026-09-23 12:41
VLAI
EPSS
VEX
Title
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
Summary
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 12:40 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/joniles/mpxj/security/advisori… | x_refsource_CONFIRM |
| https://github.com/joniles/mpxj/commit/4347315afa… | x_refsource_MISC |
| https://github.com/joniles/mpxj/releases/tag/v16.5.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T12:40:42.859556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T12:41:05.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mpxj",
"vendor": "joniles",
"versions": [
{
"status": "affected",
"version": "\u003e= 7.3.0, \u003c 16.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:54:19.224Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr"
},
{
"name": "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f"
},
{
"name": "https://github.com/joniles/mpxj/releases/tag/v16.5.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/releases/tag/v16.5.0"
}
],
"source": {
"advisory": "GHSA-7952-gx68-cjqr",
"discovery": "UNKNOWN"
},
"title": "MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65829",
"datePublished": "2026-09-22T19:54:19.224Z",
"dateReserved": "2026-07-22T23:16:47.752Z",
"dateUpdated": "2026-09-23T12:41:05.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61570 (GCVE-0-2026-61570)
Vulnerability from nvd – Published: 2026-09-22 19:56 – Updated: 2026-09-24 15:19
VLAI
EPSS
VEX
Title
MPXJ: XXE Vulnerability in MerlinReader
Summary
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ's subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 15:19 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/joniles/mpxj/security/advisori… | x_refsource_CONFIRM |
| https://github.com/joniles/mpxj/commit/6e8288bc4d… | x_refsource_MISC |
| https://github.com/joniles/mpxj/releases/tag/v16.4.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61570",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T15:19:11.763969Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T15:19:20.083Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mpxj",
"vendor": "joniles",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.5.5, \u003c 16.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ\u0027s subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611: Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:56:08.061Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/joniles/mpxj/security/advisories/GHSA-5vvx-3h34-f3gj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/joniles/mpxj/security/advisories/GHSA-5vvx-3h34-f3gj"
},
{
"name": "https://github.com/joniles/mpxj/commit/6e8288bc4d1cd62842af298004dc74fe66fb0805",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/commit/6e8288bc4d1cd62842af298004dc74fe66fb0805"
},
{
"name": "https://github.com/joniles/mpxj/releases/tag/v16.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/releases/tag/v16.4.1"
}
],
"source": {
"advisory": "GHSA-5vvx-3h34-f3gj",
"discovery": "UNKNOWN"
},
"title": "MPXJ: XXE Vulnerability in MerlinReader"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61570",
"datePublished": "2026-09-22T19:56:08.061Z",
"dateReserved": "2026-07-10T16:48:39.924Z",
"dateUpdated": "2026-09-24T15:19:20.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-49771 (GCVE-0-2024-49771)
Vulnerability from nvd – Published: 2024-10-28 16:57 – Updated: 2024-10-29 13:37
VLAI
EPSS
VEX
Title
MPXJ has a Potential Path Traversal Vulnerability
Summary
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-29 13:34 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/joniles/mpxj/security/advisori… | x_refsource_CONFIRM |
| https://github.com/joniles/mpxj/commit/8002802890… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mpxj:mpxj:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mpxj",
"vendor": "mpxj",
"versions": [
{
"lessThan": "13.5.1",
"status": "affected",
"version": "8.3.5",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-49771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-29T13:34:48.543101Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T13:37:18.103Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mpxj",
"vendor": "joniles",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.3.5, \u003c 13.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T16:57:43.271Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6"
},
{
"name": "https://github.com/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0"
}
],
"source": {
"advisory": "GHSA-j945-c44v-97g6",
"discovery": "UNKNOWN"
},
"title": "MPXJ has a Potential Path Traversal Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-49771",
"datePublished": "2024-10-28T16:57:43.271Z",
"dateReserved": "2024-10-18T13:43:23.458Z",
"dateUpdated": "2024-10-29T13:37:18.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41954 (GCVE-0-2022-41954)
Vulnerability from nvd – Published: 2022-11-25 00:00 – Updated: 2025-04-23 16:34
VLAI
EPSS
VEX
Title
Temporary File Information Disclosure Vulnerability
Summary
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permissions `-rw-r--r--`. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set `java.io.tmpdir` to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-23 13:53 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/joniles/mpxj/security/advisori… | x_refsource_CONFIRM |
| https://github.com/joniles/mpxj/commit/ae0af24345… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:38.609Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849g",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849g"
},
{
"name": "https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41954",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T13:53:46.445206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T16:34:44.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mpxj",
"vendor": "joniles",
"versions": [
{
"status": "affected",
"version": "\u003c 10.14.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ\u0027s use of `File.createTempFile(..)` results in temporary files being created with the permissions `-rw-r--r--`. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set `java.io.tmpdir` to a directory to which only the user running the application has access will prevent other users from accessing these temporary files."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-377",
"description": "CWE-377: Insecure Temporary File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-07T14:55:00.142Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849g"
},
{
"name": "https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721"
}
],
"source": {
"advisory": "GHSA-jf2p-4gqj-849g",
"discovery": "UNKNOWN"
},
"title": "Temporary File Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-41954",
"datePublished": "2022-11-25T00:00:00.000Z",
"dateReserved": "2022-09-30T00:00:00.000Z",
"dateUpdated": "2025-04-23T16:34:44.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-61570 (GCVE-0-2026-61570)
Vulnerability from cvelistv5 – Published: 2026-09-22 19:56 – Updated: 2026-09-24 15:19
VLAI
EPSS
VEX
Title
MPXJ: XXE Vulnerability in MerlinReader
Summary
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ's subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 15:19 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/joniles/mpxj/security/advisori… | x_refsource_CONFIRM |
| https://github.com/joniles/mpxj/commit/6e8288bc4d… | x_refsource_MISC |
| https://github.com/joniles/mpxj/releases/tag/v16.4.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61570",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T15:19:11.763969Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T15:19:20.083Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mpxj",
"vendor": "joniles",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.5.5, \u003c 16.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ\u0027s subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611: Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:56:08.061Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/joniles/mpxj/security/advisories/GHSA-5vvx-3h34-f3gj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/joniles/mpxj/security/advisories/GHSA-5vvx-3h34-f3gj"
},
{
"name": "https://github.com/joniles/mpxj/commit/6e8288bc4d1cd62842af298004dc74fe66fb0805",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/commit/6e8288bc4d1cd62842af298004dc74fe66fb0805"
},
{
"name": "https://github.com/joniles/mpxj/releases/tag/v16.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/releases/tag/v16.4.1"
}
],
"source": {
"advisory": "GHSA-5vvx-3h34-f3gj",
"discovery": "UNKNOWN"
},
"title": "MPXJ: XXE Vulnerability in MerlinReader"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61570",
"datePublished": "2026-09-22T19:56:08.061Z",
"dateReserved": "2026-07-10T16:48:39.924Z",
"dateUpdated": "2026-09-24T15:19:20.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65829 (GCVE-0-2026-65829)
Vulnerability from cvelistv5 – Published: 2026-09-22 19:54 – Updated: 2026-09-23 12:41
VLAI
EPSS
VEX
Title
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
Summary
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 12:40 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/joniles/mpxj/security/advisori… | x_refsource_CONFIRM |
| https://github.com/joniles/mpxj/commit/4347315afa… | x_refsource_MISC |
| https://github.com/joniles/mpxj/releases/tag/v16.5.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T12:40:42.859556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T12:41:05.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mpxj",
"vendor": "joniles",
"versions": [
{
"status": "affected",
"version": "\u003e= 7.3.0, \u003c 16.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:54:19.224Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr"
},
{
"name": "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f"
},
{
"name": "https://github.com/joniles/mpxj/releases/tag/v16.5.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/releases/tag/v16.5.0"
}
],
"source": {
"advisory": "GHSA-7952-gx68-cjqr",
"discovery": "UNKNOWN"
},
"title": "MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65829",
"datePublished": "2026-09-22T19:54:19.224Z",
"dateReserved": "2026-07-22T23:16:47.752Z",
"dateUpdated": "2026-09-23T12:41:05.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-49771 (GCVE-0-2024-49771)
Vulnerability from cvelistv5 – Published: 2024-10-28 16:57 – Updated: 2024-10-29 13:37
VLAI
EPSS
VEX
Title
MPXJ has a Potential Path Traversal Vulnerability
Summary
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-29 13:34 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/joniles/mpxj/security/advisori… | x_refsource_CONFIRM |
| https://github.com/joniles/mpxj/commit/8002802890… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mpxj:mpxj:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mpxj",
"vendor": "mpxj",
"versions": [
{
"lessThan": "13.5.1",
"status": "affected",
"version": "8.3.5",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-49771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-29T13:34:48.543101Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T13:37:18.103Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mpxj",
"vendor": "joniles",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.3.5, \u003c 13.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T16:57:43.271Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6"
},
{
"name": "https://github.com/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0"
}
],
"source": {
"advisory": "GHSA-j945-c44v-97g6",
"discovery": "UNKNOWN"
},
"title": "MPXJ has a Potential Path Traversal Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-49771",
"datePublished": "2024-10-28T16:57:43.271Z",
"dateReserved": "2024-10-18T13:43:23.458Z",
"dateUpdated": "2024-10-29T13:37:18.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41954 (GCVE-0-2022-41954)
Vulnerability from cvelistv5 – Published: 2022-11-25 00:00 – Updated: 2025-04-23 16:34
VLAI
EPSS
VEX
Title
Temporary File Information Disclosure Vulnerability
Summary
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permissions `-rw-r--r--`. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set `java.io.tmpdir` to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-23 13:53 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/joniles/mpxj/security/advisori… | x_refsource_CONFIRM |
| https://github.com/joniles/mpxj/commit/ae0af24345… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:38.609Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849g",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849g"
},
{
"name": "https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41954",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T13:53:46.445206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T16:34:44.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mpxj",
"vendor": "joniles",
"versions": [
{
"status": "affected",
"version": "\u003c 10.14.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ\u0027s use of `File.createTempFile(..)` results in temporary files being created with the permissions `-rw-r--r--`. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set `java.io.tmpdir` to a directory to which only the user running the application has access will prevent other users from accessing these temporary files."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-377",
"description": "CWE-377: Insecure Temporary File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-07T14:55:00.142Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849g"
},
{
"name": "https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721"
}
],
"source": {
"advisory": "GHSA-jf2p-4gqj-849g",
"discovery": "UNKNOWN"
},
"title": "Temporary File Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-41954",
"datePublished": "2022-11-25T00:00:00.000Z",
"dateReserved": "2022-09-30T00:00:00.000Z",
"dateUpdated": "2025-04-23T16:34:44.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}