{"id":"CVE-2026-65829","aliases":["EUVD-2026-84819","GHSA-7952-gx68-cjqr","PYSEC-2026-4108"],"status":"published","title":"MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers","description":"MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00429,"percentile":0.37404,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-09-22T19:54:19Z","modified":"2026-10-28T10:55:12Z","fixes":[{"ecosystem":"NuGet","package":"MPXJ.Net","fixed_in":["16.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"RubyGems","package":"mpxj","fixed_in":["16.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"mpxj","fixed_in":["16.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"net.sf.mpxj","fixed_in":["16.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"net.sf.mpxj-for-csharp","fixed_in":["16.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"net.sf.mpxj-for-vb","fixed_in":["16.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"net.sf.mpxj:mpxj","fixed_in":["16.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"MPXJ.Net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"mpxj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"mpxj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"net.sf.mpxj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"net.sf.mpxj-for-csharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"net.sf.mpxj-for-vb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"net.sf.mpxj:mpxj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}]},{"source":"osv","ecosystem":"NuGet","package":"MPXJ.Net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.2.2","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.8.0","13.9.0","14.0.0","14.1.0","14.2.0","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.4.0","14.5.0","14.5.1","14.5.2","15.0.0","15.1.0","15.2.0","15.3.0","15.3.1","16.0.0","16.1.0","16.2.0","16.3.0","16.4.0","16.4.1"]},{"source":"osv","ecosystem":"RubyGems","package":"mpxj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.0","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","14.0.0","14.1.0","14.2.0","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.4.0","14.5.0","14.5.1","14.5.2","15.0.0","15.1.0","15.2.0","15.3.0","15.3.1","16.0.0","16.1.0","16.2.0","16.3.0","16.4.0","16.4.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.7.0","7.7.1","7.8.0","7.8.1","7.8.2","7.8.3","7.8.4","7.9.0","7.9.1","7.9.2","7.9.3","7.9.4","7.9.5","7.9.6","7.9.7","7.9.8","8.0.0","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.4.0","8.5.0","8.5.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]},{"source":"osv","ecosystem":"PyPI","package":"mpxj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","14.0.0","14.1.0","14.2.0","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.4.0","14.5.0","14.5.1","14.5.2","15.0.0","15.1.0","15.2.0","15.3.0","15.3.1","16.0.0","16.1.0","16.2.0","16.3.0","16.4.0","16.4.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]},{"source":"osv","ecosystem":"NuGet","package":"net.sf.mpxj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.0","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.7.0","7.7.1","7.8.0","7.8.1","7.8.2","7.8.3","7.8.4","7.9.0","7.9.1","7.9.2","7.9.3","7.9.4","7.9.5","7.9.7","7.9.8","8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.8","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.4.0","8.5.0","8.5.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]},{"source":"osv","ecosystem":"NuGet","package":"net.sf.mpxj-for-csharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.0","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.7.0","7.7.1","7.8.0","7.8.1","7.8.2","7.8.3","7.8.4","7.9.0","7.9.1","7.9.2","7.9.3","7.9.4","7.9.5","7.9.7","7.9.8","8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.8","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.4.0","8.5.0","8.5.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]},{"source":"osv","ecosystem":"NuGet","package":"net.sf.mpxj-for-vb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.0","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.7.0","7.7.1","7.8.0","7.8.1","7.8.2","7.8.3","7.8.4","7.9.0","7.9.1","7.9.2","7.9.3","7.9.4","7.9.5","7.9.7","7.9.8","8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.8","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.4.0","8.5.0","8.5.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]},{"source":"osv","ecosystem":"Maven","package":"net.sf.mpxj:mpxj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}],"versions":["10.0.0","10.0.1","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.0","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","14.0.0","14.1.0","14.2.0","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.4.0","14.5.0","14.5.1","14.5.2","15.0.0","15.1.0","15.2.0","15.3.0","15.3.1","16.0.0","16.1.0","16.2.0","16.3.0","16.4.0","16.4.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.7.0","7.7.1","7.8.0","7.8.1","7.8.2","7.8.3","7.8.4","7.9.0","7.9.1","7.9.2","7.9.3","7.9.4","7.9.5","7.9.7","7.9.8","8.0.0","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.4.0","8.5.0","8.5.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]},{"source":"osv","ecosystem":"PyPI","package":"mpxj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"16.5.0"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","14.0.0","14.1.0","14.2.0","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.4.0","14.5.0","14.5.1","14.5.2","15.0.0","15.1.0","15.2.0","15.3.0","15.3.1","16.0.0","16.1.0","16.2.0","16.3.0","16.4.0","16.4.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]}],"products":[{"vendor":"joniles","product":"mpxj"}],"references":[{"url":"https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/joniles/mpxj/releases/tag/v16.5.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-7952-gx68-cjqr","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65829.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65829","tags":["advisory"]},{"url":"https://github.com/joniles/mpxj","tags":["package"]},{"url":"https://pypi.org/project/mpxj","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-65829","title":"MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers","description":"MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.","status":"published","published":"2026-09-22T19:54:19.224Z","modified":"2026-09-23T12:41:05.423Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:37:13.934727Z"}],"euvd":[{"id":"EUVD-2026-84819","description":"MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.","status":"published","published":"2026-09-22T19:54:19Z","modified":"2026-09-23T12:41:05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:01.283316Z"}],"ghsa":[{"id":"GHSA-7952-gx68-cjqr","title":"MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers","description":"### Impact\nWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system.\n\n### Patches\nThis issue is addressed in MPXJ version 16.5.0.\n\n### Workarounds\nDo not read PRX or STX files from untrusted sources.","status":"published","published":"2026-09-22T20:34:27Z","modified":"2026-09-22T20:34:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:19.455935Z"}],"nvd":[{"id":"CVE-2026-65829","description":"MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.","status":"published","published":"2026-09-22T20:17:05.06Z","modified":"2026-09-23T18:12:04.247Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-65829","title":"MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers","description":"MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.","status":"published","published":"2026-09-22T19:54:19.224Z","modified":"2026-10-28T10:55:12.428437023Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"GHSA-7952-gx68-cjqr","title":"MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers","description":"### Impact\nWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system.\n\n### Patches\nThis issue is addressed in MPXJ version 16.5.0.\n\n### Workarounds\nDo not read PRX or STX files from untrusted sources.","status":"published","published":"2026-09-22T20:34:27Z","modified":"2026-10-01T17:56:20.83893592Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"PYSEC-2026-4108","title":"MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers","description":"### Impact\nWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system.\n\n### Patches\nThis issue is addressed in MPXJ version 16.5.0.\n\n### Workarounds\nDo not read PRX or STX files from untrusted sources.","status":"published","published":"2026-10-01T16:38:34.692777Z","modified":"2026-10-01T17:45:10.038217678Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}