CVE-2026-61570: MPXJ XXE vulnerability in MerlinReader

CVE-2026-61570 · Severity: high · CVSS 7.5 · Published 2026-09-22

MPXJ is a library that reads and writes project management files in various formats, including Merlin project files stored as SQLite databases. Due to improper XML parser configuration, an attacker can craft a malicious Merlin project file to trigger XXE (XML External Entity) attacks that attempt to read arbitrary files from the system. While file contents are unlikely to be directly exfiltrated through the parsed output, the vulnerability could still expose sensitive local files and serve as a reconnaissance tool for further attacks.

Technologies: net.sf.mpxj:mpxj (Maven), MPXJ.Net (NuGet), net.sf.mpxj (NuGet), net.sf.mpxj-for-csharp (NuGet), net.sf.mpxj-for-vb (NuGet), mpxj (PyPI), mpxj (RubyGems). Vendors: Maven, NuGet, PyPI, RubyGems.

Quick answers

Is CVE-2026-61570 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61570 being exploited in the wild.
How severe is CVE-2026-61570?
High severity, with a CVSS score of 7.5, published 22 September 2026.
Which products and versions are affected?
net.sf.mpxj:mpxj (Maven) >= 5.5.5, < 16.4.1, ECOSYSTEM:introduced=5.5.5,fixed=16.4.1; MPXJ.Net (NuGet) >= 5.5.5, < 16.4.1, ECOSYSTEM:introduced=5.5.5,fixed=16.4.1; net.sf.mpxj (NuGet) >= 5.5.5, < 16.4.1, ECOSYSTEM:introduced=5.5.5,fixed=16.4.1; net.sf.mpxj-for-csharp (NuGet) >= 5.5.5, < 16.4.1, ECOSYSTEM:introduced=5.5.5,fixed=16.4.1; and 3 more.
Is there a fix for CVE-2026-61570?
Yes. net.sf.mpxj:mpxj (Maven): upgrade to 16.4.1 or later; MPXJ.Net (NuGet): upgrade to 16.4.1 or later; net.sf.mpxj (NuGet): upgrade to 16.4.1 or later; net.sf.mpxj-for-csharp (NuGet): upgrade to 16.4.1 or later; net.sf.mpxj-for-vb (NuGet): upgrade to 16.4.1 or later; mpxj (PyPI): upgrade to 16.4.1 or later; mpxj (RubyGems): upgrade to 16.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61570 attacked?
It is attacked over the network.
Am I affected by CVE-2026-61570?
Check whether you run net.sf.mpxj:mpxj (Maven), MPXJ.Net (NuGet), net.sf.mpxj (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • net.sf.mpxj:mpxj (Maven): upgrade to 16.4.1 or later
    # set net.sf.mpxj:mpxj to 16.4.1 in your pom.xml or build.gradle
  • MPXJ.Net (NuGet): upgrade to 16.4.1 or later
    dotnet add package MPXJ.Net --version 16.4.1
  • net.sf.mpxj (NuGet): upgrade to 16.4.1 or later
    dotnet add package net.sf.mpxj --version 16.4.1
  • net.sf.mpxj-for-csharp (NuGet): upgrade to 16.4.1 or later
    dotnet add package net.sf.mpxj-for-csharp --version 16.4.1
  • net.sf.mpxj-for-vb (NuGet): upgrade to 16.4.1 or later
    dotnet add package net.sf.mpxj-for-vb --version 16.4.1
  • mpxj (PyPI): upgrade to 16.4.1 or later
    pip install "mpxj>=16.4.1"
  • mpxj (RubyGems): upgrade to 16.4.1 or later
    bundle update mpxj

Technical details

The vulnerability is an XML External Entity (XXE) injection (CWE-611) in MPXJ's MerlinReader component. The root cause is that MPXJ creates DocumentBuilder instances with default configuration, leaving DOCTYPE declarations enabled when parsing XML content from the ZTIMEINTERVALS column of Merlin SQLite project files. An attacker with the ability to provide a crafted Merlin project file can include malicious DOCTYPE declarations that reference external entities, allowing arbitrary file reads on the system. The attack requires network access to provide the malicious file but no authentication or user interaction beyond file parsing. Although file contents can theoretically be accessed, MPXJ's subsequent XML processing means exfiltration is unlikely. The vulnerability affects MPXJ versions 5.5.5 through 16.4.0; patch 16.4.1 and later disable DOCTYPE declarations during XML parsing.

Affected products

  • MPXJ MPXJ 5.5.5 to 16.4.0
  • MPXJ MPXJ.Net 5.5.5 to 16.4.0
  • MPXJ net.sf.mpxj 5.5.5 to 16.4.0
  • MPXJ net.sf.mpxj-for-csharp 5.5.5 to 16.4.0
  • MPXJ net.sf.mpxj-for-vb 5.5.5 to 16.4.0

Identifiers

  • CVE-2026-61570
  • GHSA-5vvx-3h34-f3gj
  • PYSEC-2026-4107

Timeline

  • 2026-09-22: disclosed: Vulnerability published on GitHub Advisory Database
  • 2026-09-22: patched: Fix included in version 16.4.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.