{"id":"EUVD-2026-84819","enisaUuid":"e67ada13-e38b-3323-b309-99477bbc1678","description":"MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.","datePublished":"Sep 22, 2026, 7:54:19 PM","dateUpdated":"Sep 23, 2026, 12:41:05 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr\nhttps://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f\nhttps://github.com/joniles/mpxj/releases/tag/v16.5.0\n","aliases":"CVE-2026-65829\nGHSA-7952-gx68-cjqr\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"d537b334-eaa4-303c-bfbf-cd45a47e0435","product":{"name":"mpxj","vendor":{"name":"joniles"}},"product_version":"7.3.0, \u003c 16.5.0"}],"enisaIdVendor":[{"id":"c2b4ad40-9da9-3e8f-a869-e6ae9fe70147","vendor":{"name":"joniles"}}],"enisaIdVulnerability":[{"id":"05bc0088-e95b-3616-89f0-984e070aba71","vulnerability":{"id":"GHSA-7952-gx68-cjqr","description":"MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers","datePublished":"Sep 22, 2026, 8:34:27 PM","dateUpdated":"Sep 22, 2026, 8:34:27 PM","baseScore":0.0,"references":"https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr\nhttps://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f\nhttps://github.com/joniles/mpxj\nhttps://github.com/joniles/mpxj/releases/tag/v16.5.0\n","enisa_id":"EUVD-2026-84819\n","aliases":"GHSA-7952-gx68-cjqr\nCVE-2026-65829\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:06:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a0c597e0-963d-39d2-8ba6-11e4e1f46e9d","vulnerability":{"id":"CVE-2026-65829","description":"MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.","datePublished":"Sep 22, 2026, 7:54:19 PM","dateUpdated":"Sep 23, 2026, 12:41:05 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr\nhttps://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f\nhttps://github.com/joniles/mpxj/releases/tag/v16.5.0\n","enisa_id":"EUVD-2026-84819\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Nov 7, 2026, 7:20:02 AM","vulnerabilityProduct":[{"id":"81050443-217c-3862-8816-74ea82c24108","product":{"name":"mpxj","vendor":{"name":"joniles"}},"product_version":"7.3.0, \u003c 16.5.0"}],"vulnerabilityVendor":[{"id":"d45a72c5-4676-3755-a8a0-b75a16f5fdef","vendor":{"name":"joniles"}}]}},{"id":"e71d1c8e-c9aa-3c06-87b5-112d221c4c70","vulnerability":{"id":"PYSEC-2026-4108","description":"MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers","datePublished":"Oct 1, 2026, 4:38:34 PM","dateUpdated":"Oct 1, 2026, 5:10:32 PM","baseScore":0.0,"references":"https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr\nhttps://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f\nhttps://github.com/joniles/mpxj\nhttps://github.com/joniles/mpxj/releases/tag/v16.5.0\nhttps://pypi.org/project/mpxj\nhttps://github.com/advisories/GHSA-7952-gx68-cjqr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65829\n","enisa_id":"EUVD-2026-84819\n","aliases":"CVE-2026-65829\nGHSA-7952-gx68-cjqr\n","epss":0.0,"dataProcessed":"Nov 7, 2026, 7:07:43 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}