Every CVE Search/ Get API key

CVE-2024-49771

MPXJ has a Potential Path Traversal Vulnerability

5.3 MediumFix available

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.48%Up 0.4 points since Oct 29, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

MPXJ has a Potential Path Traversal Vulnerability

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.

Record
CVE-2024-49771
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2024-3068 5.3

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.

Record
EUVD-2024-3068
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-j945-c44v-97g6 5.3

MPXJ has a Potential Path Traversal Vulnerability

Impact

The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations.

Patches

The issue is addressed in MPXJ version 13.5.1

Workarounds

Do not pass zip files to MPXJ.

References

N/A

Credits

Issue report and patch provided by yyjLF and sprinkle

Record
GHSA-j945-c44v-97g6
CVSS 4.0
5.3 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 5.3

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.

Record
CVE-2024-49771
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 5.3

MPXJ has a Potential Path Traversal Vulnerability

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.

Record
CVE-2024-49771
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-j945-c44v-97g6 5.3

MPXJ has a Potential Path Traversal Vulnerability

Impact

The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations.

Patches

The issue is addressed in MPXJ version 13.5.1

Workarounds

Do not pass zip files to MPXJ.

References

N/A

Credits

Issue report and patch provided by yyjLF and sprinkle

Record
GHSA-j945-c44v-97g6
CVSS 4.0
5.3 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVPYSEC-2026-1681 5.3

MPXJ has a Potential Path Traversal Vulnerability

Impact

The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations.

Patches

The issue is addressed in MPXJ version 13.5.1

Workarounds

Do not pass zip files to MPXJ.

References

N/A

Credits

Issue report and patch provided by yyjLF and sprinkle

Record
PYSEC-2026-1681
CVSS 4.0
5.3 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
net.sf.mpxj:mpxj
Maven
 8.3.5 up to 13.5.1
13.5.1
mpxj
RubyGems
 8.3.5 up to 13.5.1
13.5.1
mpxj
PyPI
 8.3.5 up to 13.5.1
13.5.1
net.sf.mpxj
NuGet
 8.3.5 up to 13.5.1
13.5.1
net.sf.mpxj-for-csharp
NuGet
 8.3.5 up to 13.5.1
13.5.1
net.sf.mpxj-for-vb
NuGet
 8.3.5 up to 13.5.1
13.5.1
MPXJ.Net
NuGet
 13.0.0 up to 13.5.1
13.5.1
net.sf.mpxj:mpxj
Maven
 8.3.5 up to 13.5.1, plus listed versions
10.0.010.0.110.0.310.0.410.0.5
Show 45 moreShow less
10.1.010.10.010.11.010.12.010.13.010.14.010.14.110.15.010.16.010.16.110.16.210.2.010.3.010.4.010.5.010.6.010.6.110.6.210.7.010.8.010.9.010.9.111.0.011.1.011.2.011.3.011.3.111.3.211.4.011.5.011.5.111.5.211.5.311.5.412.0.012.0.112.0.212.1.012.1.112.1.212.1.312.10.012.10.112.10.212.10.3
13.5.1
mpxj
RubyGems
 8.3.5 up to 13.5.1, plus listed versions
10.0.010.0.110.0.210.0.310.0.4
Show 45 moreShow less
10.0.510.1.010.10.010.11.010.12.010.13.010.14.010.14.110.15.010.16.010.16.110.16.210.2.010.3.010.4.010.5.010.6.010.6.110.6.210.7.010.8.010.9.010.9.111.0.011.1.011.2.011.3.011.3.111.3.211.4.011.5.011.5.111.5.211.5.311.5.412.0.012.0.112.0.212.1.012.1.112.1.212.1.312.10.012.10.112.10.2
13.5.1
mpxj
PyPI
 8.3.5 up to 13.5.1, plus listed versions
10.0.010.0.110.0.210.0.310.0.4
Show 45 moreShow less
10.0.510.1.010.10.010.11.010.12.010.13.010.14.010.14.110.15.010.16.010.16.110.16.210.2.010.3.010.4.010.5.010.6.010.6.110.6.210.7.010.8.010.9.010.9.111.0.011.1.011.2.011.3.011.3.111.3.211.4.011.5.011.5.111.5.211.5.311.5.412.0.012.0.112.0.212.1.112.1.212.1.312.10.012.10.112.10.212.10.3
13.5.1
Show 4 moreShow less
Affected packages
PackageAffectedFixed
net.sf.mpxj
NuGet
 8.3.5 up to 13.5.1, plus listed versions
10.0.010.0.110.0.210.0.310.0.4
Show 45 moreShow less
10.0.510.1.010.10.010.11.010.12.010.13.010.14.010.14.110.15.010.16.010.16.110.16.210.2.010.3.010.4.010.5.010.6.010.6.110.6.210.7.010.8.010.9.010.9.111.0.011.1.011.2.011.3.011.3.111.3.211.4.011.5.011.5.111.5.211.5.311.5.412.0.012.0.112.0.212.1.012.1.112.1.212.1.312.10.012.10.112.10.2
13.5.1
net.sf.mpxj-for-csharp
NuGet
 8.3.5 up to 13.5.1, plus listed versions
10.0.010.0.110.0.210.0.310.0.4
Show 45 moreShow less
10.0.510.1.010.10.010.11.010.12.010.13.010.14.010.14.110.15.010.16.010.16.110.16.210.2.010.3.010.4.010.5.010.6.010.6.110.6.210.7.010.8.010.9.010.9.111.0.011.1.011.2.011.3.011.3.111.3.211.4.011.5.011.5.111.5.211.5.311.5.412.0.012.0.112.0.212.1.012.1.112.1.212.1.312.10.012.10.112.10.2
13.5.1
net.sf.mpxj-for-vb
NuGet
 8.3.5 up to 13.5.1, plus listed versions
10.0.010.0.110.0.210.0.310.0.4
Show 45 moreShow less
10.0.510.1.010.10.010.11.010.12.010.13.010.14.010.14.110.15.010.16.010.16.110.16.210.2.010.3.010.4.010.5.010.6.010.6.110.6.210.7.010.8.010.9.010.9.111.0.011.1.011.2.011.3.011.3.111.3.211.4.011.5.011.5.111.5.211.5.311.5.412.0.012.0.112.0.212.1.012.1.112.1.212.1.312.10.012.10.112.10.2
13.5.1
MPXJ.Net
NuGet
 13.0.0 up to 13.5.1, plus listed versions
13.0.113.0.213.1.013.2.013.2.1
Show 7 moreShow less
13.2.213.3.013.3.113.4.013.4.113.4.213.5.0
13.5.1

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-49771 is a medium vulnerability (CVSS 5.3) in Joniles Mpxj, published October 28, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in net.sf.mpxj:mpxj 13.5.1.

References

This page doesn't list everything

Left out here: 288 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open