Medium severity5.3NVD Advisory· Published Sep 22, 2026· Updated Sep 23, 2026
CVE-2026-65829
CVE-2026-65829
Description
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
MPXJ.NetNuGet | >= 7.3.0, < 16.5.0 | 16.5.0 |
mpxjRubyGems | >= 7.3.0, < 16.5.0 | 16.5.0 |
mpxjPyPI | >= 7.3.0, < 16.5.0 | 16.5.0 |
net.sf.mpxjNuGet | >= 7.3.0, < 16.5.0 | 16.5.0 |
net.sf.mpxj-for-csharpNuGet | >= 7.3.0, < 16.5.0 | 16.5.0 |
net.sf.mpxj-for-vbNuGet | >= 7.3.0, < 16.5.0 | 16.5.0 |
net.sf.mpxj:mpxjMaven | >= 7.3.0, < 16.5.0 | 16.5.0 |
Affected products
1Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.