MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
### Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. ### Patches This issue is addressed in MPXJ version 16.5.0. ### Workarounds Do not read PRX or STX files from untrusted sources.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-65829US | — | — | ||
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-7952-gx68-cjqrADVISORY
- https://github.com/joniles/mpxjPACKAGE
- https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6fWEB
- https://github.com/joniles/mpxj/releases/tag/v16.5.0WEB
- https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqrWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-65829ADVISORY
- https://pypi.org/project/mpxjPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan