Medium severity5.3NVD Advisory· Published Sep 22, 2026

CVE-2026-65829

Description

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-7952-gx68-cjqrghsaADVISORY
github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6fnvd
github.com/joniles/mpxj/releases/tag/v16.5.0nvd
github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqrnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000