CVE-2026-61570: MPXJ: XXE Vulnerability in MerlinReader
Impact MPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration.
Patches The patch is included in MPXJ 16.4.1
Workarounds Potential workarounds include: Avoid reading Merlin project files with MPXJ Only accept Merlin project files from trusted sources Preprocess Merlin SQLite databases to strip doctype declarations from the ZTIMEINTERVALS column
Other sources
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ's subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mpxjto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
nuget/net.sf.mpxj-for-vbto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
nuget/net.sf.mpxj-for-csharpto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
nuget/net.sf.mpxjto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
nuget/MPXJ.Netto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
rubygems/mpxjto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
maven/net.sf.mpxj:mpxjto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
MPXJto a version that resolves this vulnerability.Fixed in 16.4.1 - Compensating control
Avoid reading Merlin project files with MPXJ.
- Compensating control
Only accept Merlin project files from trusted sources.
- Compensating control
Preprocess Merlin SQLite databases to strip doctype declarations from the ZTIMEINTERVALS column.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using MPXJ versions from 5.5.5 through versions before 16.4.1 are exposed when they parse a Merlin project SQLite database containing attacker-controlled content in the ZTIMEINTERVALS column.
What does an attacker need to exploit it?
An attacker needs to provide or cause the application to process a crafted Merlin project SQLite database. No authentication or user interaction is required by the vulnerability metrics, but exploitation depends on the application accepting and parsing the malicious database.
What is the practical impact?
The XML parser can be induced to read an arbitrary local file through external entity processing. However, MPXJ's subsequent XML handling makes disclosure of the file contents unlikely.
What should teams do if they cannot upgrade immediately?
Avoid processing untrusted Merlin project SQLite databases, particularly databases whose ZTIMEINTERVALS data may be attacker-controlled. Upgrade to MPXJ 16.4.1 when possible.