CVE-2026-65829: MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system.
Patches This issue is addressed in MPXJ version 16.5.0.
Workarounds Do not read PRX or STX files from untrusted sources.
Other sources
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/net.sf.mpxj:mpxjto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
nuget/net.sf.mpxj-for-vbto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
nuget/net.sf.mpxj-for-csharpto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
nuget/net.sf.mpxjto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
pip/mpxjto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
rubygems/mpxjto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
nuget/MPXJ.Netto a version that resolves this vulnerability.Fixed in 16.5.0 - Upgrade
Upgrade
MPXJto a version that resolves this vulnerability.Fixed in 16.5.0 - Compensating control
Do not read PRX or STX files from untrusted sources.
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using MPXJ versions from 7.3.0 through versions before 16.5.0 are exposed when they read Primavera P3 PRX or SureTrak STX files. The affected behavior is in the readers for those file formats.
What does an attacker need to exploit this issue?
An attacker needs to cause the application to read a suitably crafted Primavera P3 PRX or SureTrak STX file. No authentication or user interaction is required according to the supplied vector.
What is the impact of successful exploitation?
A crafted file can cause MPXJ to write files to arbitrary filesystem locations. The reported impact is integrity modification; no confidentiality or availability impact is specified.
How can this be remediated?
Upgrade MPXJ to version 16.5.0, which fixes the issue.