Executive brief
MPXJ is a library that reads and writes project management files in various formats, including Merlin project files stored as SQLite databases. Due to improper XML parser configuration, an attacker can craft a malicious Merlin project file to trigger XXE (XML External Entity) attacks that attempt to read arbitrary files from the system. While file contents are unlikely to be directly exfiltrated through the parsed output, the vulnerability could still expose sensitive local files and serve as a reconnaissance tool for further attacks.
Technical details
The vulnerability is an XML External Entity (XXE) injection (CWE-611) in MPXJ's MerlinReader component. The root cause is that MPXJ creates DocumentBuilder instances with default configuration, leaving DOCTYPE declarations enabled when parsing XML content from the ZTIMEINTERVALS column of Merlin SQLite project files. An attacker with the ability to provide a crafted Merlin project file can include malicious DOCTYPE declarations that reference external entities, allowing arbitrary file reads on the system. The attack requires network access to provide the malicious file but no authentication or user interaction beyond file parsing. Although file contents can theoretically be accessed, MPXJ's subsequent XML processing means exfiltration is unlikely. The vulnerability affects MPXJ versions 5.5.5 through 16.4.0; patch 16.4.1 and later disable DOCTYPE declarations during XML parsing.
Affected products
- MPXJ MPXJ 5.5.5 to 16.4.0
- MPXJ MPXJ.Net 5.5.5 to 16.4.0
- MPXJ net.sf.mpxj 5.5.5 to 16.4.0
- MPXJ net.sf.mpxj-for-csharp 5.5.5 to 16.4.0
- MPXJ net.sf.mpxj-for-vb 5.5.5 to 16.4.0
Timeline
- 2026-09-22: disclosed: Vulnerability published on GitHub Advisory Database
- 2026-09-22: patched: Fix included in version 16.4.1