CVE-2026-61570
highPriorität · verfolgen · 0EPSS 0.005 · 41. PerzentilUSEPSS · bewertet 2026-10-27
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ's subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (7)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-5vvx-3h34-f3gjMPXJ: XXE Vulnerability in MerlinReader2026-09-22ghsa · osvUS
### Impact MPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. ### Patches The patch is included in MPXJ 16.4.1 ### Workarounds Potential workarounds include: * Avoid reading Merlin project files with MPXJ * Only accept Merlin project files from trusted sources * Preprocess Merlin SQLite databases to strip doctype declarations from the ZTIMEINTERVALS column
- PYSEC-2026-4107MPXJ: XXE Vulnerability in MerlinReader2026-10-01vendor · osvUS
### Impact MPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. ### Patches The patch is included in MPXJ 16.4.1 ### Workarounds Potential workarounds include: * Avoid reading Merlin project files with MPXJ * Only accept Merlin project files from trusted sources * Preprocess Merlin SQLite databases to strip doctype declarations from the ZTIMEINTERVALS column
auch bekannt als (2)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (3) nvd
Externe Belege — Patches, Meldungen, Analysen.
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan