GHSA-7952-gx68-cjqr

ghsaUSosv

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

view advisory published 2026-09-22Licence: CC-BY-4.0

### Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. ### Patches This issue is addressed in MPXJ version 16.5.0. ### Workarounds Do not read PRX or STX files from untrusted sources.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-65829US	—	0.43% (37th)	—	2026-09-22
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or…

references

External citations — patches, advisories, analysis.

https://github.com/joniles/mpxjPACKAGE
https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6fWEB
https://github.com/joniles/mpxj/releases/tag/v16.5.0WEB
https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqrWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan