Feed/CVE-2026-65829
CVE-2026-65829MEDIUMCVSS 5.3

CVE-2026-65829

Published Sep 22, 2026·Updated Sep 22, 2026

NVD Description

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.

Affected Packages (7)

net.sf.mpxj-for-vbNUGET
From 7.3.0
Fixed in 16.5.0
net.sf.mpxj:mpxjMAVEN
From 7.3.0
Fixed in 16.5.0
mpxjPYPI
From 7.3.0
Fixed in 16.5.0
net.sf.mpxjNUGET
From 7.3.0
Fixed in 16.5.0
MPXJ.NetNUGET
From 7.3.0
Fixed in 16.5.0
net.sf.mpxj-for-csharpNUGET
From 7.3.0
Fixed in 16.5.0
mpxjGEM
From 7.3.0
Fixed in 16.5.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free