Every CVE Search/ Get API key

CVE-2022-41954

Temporary File Information Disclosure Vulnerability

3.3 LowFix available

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of File.createTempFile(..) results in temporary files being created with the permissions -rw-r--r--. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set java.io.tmpdir to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.21%Down 0.7 points since Nov 26, 2022
90%50%10%1%

What each source reports

CVE List Score used 3.3

Temporary File Information Disclosure Vulnerability

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of File.createTempFile(..) results in temporary files being created with the permissions -rw-r--r--. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set java.io.tmpdir to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

Record
CVE-2022-41954
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-377
Updated
2026-11-02
EUVDEUVD-2022-0160 3.3

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of File.createTempFile(..) results in temporary files being created with the permissions -rw-r--r--. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set java.io.tmpdir to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

Record
EUVD-2022-0160
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jf2p-4gqj-849g 2.0

Temporary File Information Disclosure vulnerability in MPXJ

Impact

On Unix-like operating systems (not Windows or macos), MPXJ's use of File.createTempFile(..) results in temporary files being created with the permissions -rw-r--r--. This means that any other user on the system can read the contents of this file. When MPXJ is reading a type of schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ.

Patches

The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes.

Workarounds

Setting java.io.tmpdir to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

For more information

If you have any questions or comments about this advisory

Record
GHSA-jf2p-4gqj-849g
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
2.8 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-668
Updated
2026-11-02
NVD 3.3

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of File.createTempFile(..) results in temporary files being created with the permissions -rw-r--r--. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set java.io.tmpdir to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

Record
CVE-2022-41954
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-377, CWE-668
Updated
2026-11-02
OSV 3.3

Temporary File Information Disclosure Vulnerability

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of File.createTempFile(..) results in temporary files being created with the permissions -rw-r--r--. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set java.io.tmpdir to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

Record
CVE-2022-41954
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-377
Updated
2026-11-02
OSVGHSA-jf2p-4gqj-849g 2.0

Temporary File Information Disclosure vulnerability in MPXJ

Impact

On Unix-like operating systems (not Windows or macos), MPXJ's use of File.createTempFile(..) results in temporary files being created with the permissions -rw-r--r--. This means that any other user on the system can read the contents of this file. When MPXJ is reading a type of schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ.

Patches

The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes.

Workarounds

Setting java.io.tmpdir to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

For more information

If you have any questions or comments about this advisory

Record
GHSA-jf2p-4gqj-849g
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
2.8 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-668
Updated
2026-11-02
OSVPYSEC-2022-42996 No score

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of File.createTempFile(..) results in temporary files being created with the permissions -rw-r--r--. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set java.io.tmpdir to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

Record
PYSEC-2022-42996
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
net.sf.mpxj:mpxj
Maven
 before 10.14.1
10.14.1
net.sf.mpxj
NuGet
 before 10.14.1
10.14.1
net.sf.mpxj-for-csharp
NuGet
 before 10.14.1
10.14.1
net.sf.mpxj-for-vb
NuGet
 before 10.14.1
10.14.1
mpxj
PyPI
 before 10.14.1
10.14.1
net.sf.mpxj:mpxj
Maven
 before 10.14.1, plus listed versions
10.0.010.0.110.0.310.0.410.0.5
Show 45 moreShow less
10.1.010.10.010.11.010.12.010.13.010.14.010.2.010.3.010.4.010.5.010.6.010.6.110.6.210.7.010.8.010.9.010.9.14.7.14.7.24.7.34.7.44.7.54.7.65.0.05.1.05.1.105.1.115.1.125.1.135.1.155.1.165.1.175.1.185.1.45.1.95.10.05.11.05.12.05.13.05.14.05.2.05.2.15.2.25.3.05.3.1
10.14.1
net.sf.mpxj
NuGet
 before 10.14.1, plus listed versions
10.0.010.0.110.0.210.0.310.0.4
Show 45 moreShow less
10.0.510.1.010.10.010.11.010.12.010.13.010.14.010.2.010.3.010.4.010.5.010.6.010.6.110.6.210.7.010.8.010.9.010.9.14.6.04.6.14.6.24.7.04.7.14.7.34.7.44.7.54.7.65.0.05.1.05.1.105.1.115.1.125.1.135.1.155.1.165.1.175.1.185.1.45.1.55.1.95.10.05.11.05.12.05.13.05.14.0
10.14.1
net.sf.mpxj-for-csharp
NuGet
 before 10.14.1, plus listed versions
10.0.010.0.110.0.210.0.310.0.4
Show 45 moreShow less
10.0.510.1.010.10.010.11.010.12.010.13.010.14.010.2.010.3.010.4.010.5.010.6.010.6.110.6.210.7.010.8.010.9.010.9.14.6.14.6.24.7.04.7.14.7.34.7.44.7.54.7.65.0.05.1.05.1.105.1.115.1.125.1.135.1.155.1.165.1.175.1.185.1.45.1.55.1.95.10.05.11.05.12.05.13.05.14.05.2.0
10.14.1
net.sf.mpxj-for-vb
NuGet
 before 10.14.1, plus listed versions
10.0.010.0.110.0.210.0.310.0.4
Show 45 moreShow less
10.0.510.1.010.10.010.11.010.12.010.13.010.14.010.2.010.3.010.4.010.5.010.6.010.6.110.6.210.7.010.8.010.9.010.9.14.6.14.6.24.7.04.7.14.7.34.7.44.7.54.7.65.0.05.1.05.1.105.1.115.1.125.1.135.1.155.1.165.1.175.1.185.1.45.1.55.1.95.10.05.11.05.12.05.13.05.14.05.2.0
10.14.1
mpxj
PyPI
 before 10.14.1, plus listed versions
10.0.010.0.110.0.210.0.310.0.4
Show 39 moreShow less
10.0.510.1.010.10.010.11.010.12.010.13.010.14.010.2.010.3.010.4.010.5.010.6.010.6.110.6.210.7.010.8.010.9.010.9.19.0.09.1.09.2.09.2.19.2.29.2.39.2.49.2.59.2.69.3.09.3.19.4.09.5.09.5.19.5.29.6.09.7.09.8.09.8.19.8.29.8.3
10.14.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-41954 is a low vulnerability (CVSS 3.3) in Joniles Mpxj, published November 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 12th percentile. Fixed in net.sf.mpxj:mpxj 10.14.1.

References

This page doesn't list everything

Left out here: 432 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open