cyfenced.com →

[ CVE-2026-65829 · Published 22 Sep 2026 ]

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

CVSS 5.3 EPSS <1%Fix available

[ Description ]Official description

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.

[ Fixes ]Fixes and patches

  • MPXJ.Net 16.5.0Fixed version · GitHub Advisories · nuget package MPXJ.Net: upgrade to 16.5.0 or later (affected >= 7.3.0, < 16.5.0)
  • mpxj 16.5.0Fixed version · GitHub Advisories · rubygems package mpxj: upgrade to 16.5.0 or later (affected >= 7.3.0, < 16.5.0)
  • net.sf.mpxj 16.5.0Fixed version · GitHub Advisories · nuget package net.sf.mpxj: upgrade to 16.5.0 or later (affected >= 7.3.0, < 16.5.0)
  • net.sf.mpxj-for-csharp 16.5.0Fixed version · GitHub Advisories · nuget package net.sf.mpxj-for-csharp: upgrade to 16.5.0 or later (affected >= 7.3.0, < 16.5.0)
  • net.sf.mpxj-for-vb 16.5.0Fixed version · GitHub Advisories · nuget package net.sf.mpxj-for-vb: upgrade to 16.5.0 or later (affected >= 7.3.0, < 16.5.0)
  • net.sf.mpxj:mpxj 16.5.0Fixed version · GitHub Advisories · maven package net.sf.mpxj:mpxj: upgrade to 16.5.0 or later (affected >= 7.3.0, < 16.5.0)

[ Packages ]Affected open-source packages

[ References ]References