# CVE-2022-41954: Temporary File Information Disclosure vulnerability in MPXJ

Source: https://junglewise.ai/threats/cve-2022-41954-temporary-file-information-disclosure-vulnerability-in-mpxj  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-11-25  
License: CC BY 4.0 with a link back

CVE-2022-41954 · Severity: low · CVSS 3.1 · Published 2022-11-25

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permissions `-rw-r--r--`. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set `java.io.tmpdir` to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

Technologies: [net.sf.mpxj:mpxj (Maven)](https://junglewise.ai/threats/technologies/net-sf-mpxj-mpxj), [net.sf.mpxj (NuGet)](https://junglewise.ai/threats/technologies/net-sf-mpxj), [net.sf.mpxj-for-csharp (NuGet)](https://junglewise.ai/threats/technologies/net-sf-mpxj-for-csharp), [net.sf.mpxj-for-vb (NuGet)](https://junglewise.ai/threats/technologies/net-sf-mpxj-for-vb), [mpxj (PyPI)](https://junglewise.ai/threats/technologies/pypi-mpxj). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [NuGet](https://junglewise.ai/threats/vendors/nuget), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-41954 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-41954 being exploited in the wild.

**How severe is CVE-2022-41954?** Low severity, with a CVSS score of 3.1, published 25 November 2022.

**Which products and versions are affected?** net.sf.mpxj:mpxj (Maven) ECOSYSTEM:introduced=0,fixed=10.14.1; net.sf.mpxj (NuGet) ECOSYSTEM:introduced=0,fixed=10.14.1; net.sf.mpxj-for-csharp (NuGet) ECOSYSTEM:introduced=0,fixed=10.14.1; net.sf.mpxj-for-vb (NuGet) ECOSYSTEM:introduced=0,fixed=10.14.1; and 1 more.

**Is there a fix for CVE-2022-41954?** Yes. net.sf.mpxj:mpxj (Maven): upgrade to 10.14.1 or later; net.sf.mpxj (NuGet): upgrade to 10.14.1 or later; net.sf.mpxj-for-csharp (NuGet): upgrade to 10.14.1 or later; net.sf.mpxj-for-vb (NuGet): upgrade to 10.14.1 or later; mpxj (PyPI): upgrade to 10.14.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2022-41954?** Check whether you run net.sf.mpxj:mpxj (Maven), net.sf.mpxj (NuGet), net.sf.mpxj-for-csharp (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- net.sf.mpxj:mpxj (Maven): upgrade to 10.14.1 or later

  ```sh
  # set net.sf.mpxj:mpxj to 10.14.1 in your pom.xml or build.gradle
  ```

- net.sf.mpxj (NuGet): upgrade to 10.14.1 or later

  ```sh
  dotnet add package net.sf.mpxj --version 10.14.1
  ```

- net.sf.mpxj-for-csharp (NuGet): upgrade to 10.14.1 or later

  ```sh
  dotnet add package net.sf.mpxj-for-csharp --version 10.14.1
  ```

- net.sf.mpxj-for-vb (NuGet): upgrade to 10.14.1 or later

  ```sh
  dotnet add package net.sf.mpxj-for-vb --version 10.14.1
  ```

- mpxj (PyPI): upgrade to 10.14.1 or later

  ```sh
  pip install "mpxj>=10.14.1"
  ```


## Affected products

- net.sf.mpxj:mpxj (Maven) ECOSYSTEM:introduced=0,fixed=10.14.1
- net.sf.mpxj (NuGet) ECOSYSTEM:introduced=0,fixed=10.14.1
- net.sf.mpxj-for-csharp (NuGet) ECOSYSTEM:introduced=0,fixed=10.14.1
- net.sf.mpxj-for-vb (NuGet) ECOSYSTEM:introduced=0,fixed=10.14.1
- mpxj (PyPI) GIT:introduced=0,fixed=287ad0234213c52b0638565e14bd9cf3ed44cedd|ECOSYSTEM:introduced=0,fixed=10.14.1

## Identifiers

- CVE-2022-41954
- GHSA-jf2p-4gqj-849g
- PYSEC-2022-42996

## Related threats

- [MPXJ path traversal in Primavera P3 PRX and SureTrak STX readers](https://junglewise.ai/threats/cve-2026-65829-mpxj-path-traversal-in-primavera-p3-prx-and-suretrak-stx-readers)
- [MPXJ XXE vulnerability in MerlinReader](https://junglewise.ai/threats/cve-2026-61570-mpxj-xxe-vulnerability-in-merlinreader)
- [PYSEC-2026-1681 - MPXJ has a Potential Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2024-49771-mpxj-has-a-potential-path-traversal-vulnerability)
- [Improper Restriction of XML External Entity Reference in MPXJ](https://junglewise.ai/threats/cve-2020-25020-improper-restriction-of-xml-external-entity-reference-in-mpxj)
- [MPXJ path Traversal vulnerability](https://junglewise.ai/threats/cve-2020-35460-mpxj-path-traversal-vulnerability)