PYSEC-2026-4107: MPXJ: XXE Vulnerability in MerlinReader

Q: Who is exposed to this issue?

Applications are exposed when they use MPXJ's MerlinReader to parse a Merlin project SQLite database from an untrusted source. The vulnerable XML is read from the database's ZTIMEINTERVALS column.

Q: What does an attacker need to exploit it?

An attacker needs to provide a crafted Merlin project SQLite database that causes MerlinReader to parse XML containing a doctype declaration and external entity. No authentication or user interaction is indicated by the supplied severity vector.

Q: Are default parser settings affected?

Yes. MerlinReader creates its DocumentBuilder with default settings, which leave doctype declarations and external entities enabled.

Q: What is the practical impact?

The crafted database can cause the XML parser to read an arbitrary local file. However, MPXJ's subsequent processing of the XML makes disclosure of that file's contents unlikely.

Q: What version fixes the problem?

Upgrade MPXJ to version 16.4.1, which fixes the issue. The affected range is from 5.5.5 until 16.4.1.

Published Sep 22, 2026

Updated

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ's subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1.

Affected Software

1 affected component

MPXJ MPXJ>=5.5.5<16.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MPXJ to a version that resolves this vulnerability.
Fixed in 16.4.1

Event History

Sep 22, 2026

CVE Published

via OSV·07:56 PM

Data Sourced

via OSV·07:56 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications are exposed when they use MPXJ's MerlinReader to parse a Merlin project SQLite database from an untrusted source. The vulnerable XML is read from the database's ZTIMEINTERVALS column.

What does an attacker need to exploit it?

An attacker needs to provide a crafted Merlin project SQLite database that causes MerlinReader to parse XML containing a doctype declaration and external entity. No authentication or user interaction is indicated by the supplied severity vector.

Are default parser settings affected?

Yes. MerlinReader creates its DocumentBuilder with default settings, which leave doctype declarations and external entities enabled.

What is the practical impact?

The crafted database can cause the XML parser to read an arbitrary local file. However, MPXJ's subsequent processing of the XML makes disclosure of that file's contents unlikely.

What version fixes the problem?

Upgrade MPXJ to version 16.4.1, which fixes the issue. The affected range is from 5.5.5 until 16.4.1.

PYSEC-2026-4107: MPXJ: XXE Vulnerability in MerlinReader

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default parser settings affected?

What is the practical impact?

What version fixes the problem?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default parser settings affected?

What is the practical impact?

What version fixes the problem?