CVE-2026-65829CWE-22path-traversal

CVE-2026-65829

Medium · published September 23, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
25.7
In the wild
Unconfirmed
What it is

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00335 · 25.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-23T00:17Z
References (3)
https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f · [email protected]https://github.com/joniles/mpxj/releases/tag/v16.5.0 · [email protected]https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr · [email protected]
EPSS history
Timeline
  • 24 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 22 SEP 19:54Z
    MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
    cvelistv5