mpxj
Primary repository for MPXJ library
View on Github
Activity
- Latest release
- 3w ago
- Total releases
- 254
- Cadence
- ~15 days
- Last 12 months
- 17
Reach
- Stars
- 350
Details
- License
- unknown
- First release
- Mar 17, 2015
| Version | Released | |
|---|---|---|
16.10.0
minor
| ||
16.9.0
minor
| ||
16.8.0
minor
| ||
16.7.0
minor
| ||
16.6.0
minor
| ||
16.5.0
minor
| ||
16.4.1
patch
1 CVE
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev | ||
16.4.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
16.3.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
16.2.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
16.1.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
16.0.0
major
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
15.3.1
patch
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
15.3.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
15.2.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
15.1.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
15.0.0
major
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.5.2
patch
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.5.1
patch
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.5.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.4.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.3.5
patch
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.3.4
patch
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.3.3
patch
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.3.2
patch
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.3.1
patch
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.3.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.2.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.1.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
14.0.0
major
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
13.12.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
13.11.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
13.10.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
13.9.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
13.8.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
13.7.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
13.6.0
minor
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
13.5.1
patch
2 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev | ||
13.5.0
minor
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
13.4.1
patch
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
13.4.0
minor
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
13.3.1
patch
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
13.3.0
minor
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
13.2.1
patch
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
13.2.0
minor
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
13.1.0
minor
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
13.0.2
patch
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
13.0.1
patch
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
13.0.0
major
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
12.10.3
patch
3 CVEs
CVE-2026-65829
GHSA-7952-gx68-cjqr
PYSEC-2026-4108
Sep 22, 2026
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
None
ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources. Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 165 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
16.4.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.5.0
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-61570
GHSA-5vvx-3h34-f3gj
PYSEC-2026-4107
Sep 22, 2026
MPXJ: XXE Vulnerability in MerlinReader
7.5
/ 10
High
Network
Low
None
None
Unchanged
High
None
None
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration. PatchesThe patch is included in MPXJ 16.4.1 WorkaroundsPotential workarounds include:
Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 197 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.10.0
13.11.0
13.12.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.5.1
13.6.0
13.7.0
13.8.0
13.9.0
14.0.0
14.1.0
14.2.0
14.3.0
14.3.1
14.3.2
14.3.3
14.3.4
14.3.5
14.4.0
14.5.0
14.5.1
14.5.2
15.0.0
15.1.0
15.2.0
15.3.0
15.3.1
16.0.0
16.1.0
16.2.0
16.3.0
16.4.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
6.0.0
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.6
7.9.7
7.9.8
8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
16.4.1
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2024-49771
GHSA-j945-c44v-97g6
PYSEC-2026-1681
Oct 28, 2024
MPXJ has a Potential Path Traversal Vulnerability
Medium
Adjacent
Low
None
None
ImpactThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. PatchesThe issue is addressed in MPXJ version 13.5.1 WorkaroundsDo not pass zip files to MPXJ. ReferencesN/A CreditsIssue report and patch provided by yyjLF and sprinkle Affected versions
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0
+ 87 more Show less
10.14.1
10.15.0
10.16.0
10.16.1
10.16.2
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.3.2
11.4.0
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
12.0.0
12.0.1
12.0.2
12.1.0
12.1.1
12.1.2
12.1.3
12.10.0
12.10.1
12.10.2
12.10.3
12.2.0
12.3.0
12.4.0
12.5.0
12.6.0
12.7.0
12.8.0
12.8.1
12.9.0
12.9.1
12.9.2
12.9.3
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
8.3.5
8.4.0
8.5.0
8.5.1
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3
Fixed in
13.5.1
References
Updated Jul 07, 2026 · Source: OSV.dev |