GitHub Advisoryadvisory · NuGet, RubyGems, PyPI, Maven

GHSA-7952-gx68-cjqr MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

MEDIUM Published 2026-09-22 Modified 2026-09-22 Official page ↗
Aliases
CVE-2026-65829
Ecosystem
NuGet, RubyGems, PyPI, Maven
Packages
MPXJ.Net, mpxj, net.sf.mpxj, net.sf.mpxj-for-csharp, net.sf.mpxj-for-vb, net.sf.mpxj:mpxj
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-22
Reviewed
2026-09-22

Affected packages

• NuGet MPXJ.Net: >= 7.3.0, < 16.5.0 → fixed in 16.5.0 • RubyGems mpxj: >= 7.3.0, < 16.5.0 → fixed in 16.5.0 • PyPI mpxj: >= 7.3.0, < 16.5.0 → fixed in 16.5.0 • NuGet net.sf.mpxj: >= 7.3.0, < 16.5.0 → fixed in 16.5.0 • NuGet net.sf.mpxj-for-csharp: >= 7.3.0, < 16.5.0 → fixed in 16.5.0 • NuGet net.sf.mpxj-for-vb: >= 7.3.0, < 16.5.0 → fixed in 16.5.0 • Maven net.sf.mpxj:mpxj: >= 7.3.0, < 16.5.0 → fixed in 16.5.0

Description

Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. Patches This issue is addressed in MPXJ version 16.5.0. Workarounds Do not read PRX or STX files from untrusted sources.

Related

Alias · CVE (1)

  • CVE-2026-65829 MPXJ is an open source library to read and write project plans from a variety of file formats and databases. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References