CVE-2026-65829: MPXJ path traversal in Primavera P3 PRX and SureTrak STX readers

CVE-2026-65829 · Severity: medium · CVSS 5.3 · Published 2026-09-22

MPXJ is a project management library used to read and process files from Microsoft Project, Primavera, and other scheduling tools. A path traversal vulnerability allows attackers to write arbitrary files to any location on the file system when processing specially crafted PRX or STX project files, potentially enabling code execution or data destruction.

Technologies: net.sf.mpxj:mpxj (Maven), MPXJ.Net (NuGet), net.sf.mpxj (NuGet), net.sf.mpxj-for-csharp (NuGet), net.sf.mpxj-for-vb (NuGet), mpxj (PyPI), mpxj (RubyGems). Vendors: Maven, NuGet, PyPI, RubyGems.

Quick answers

Is CVE-2026-65829 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-65829 being exploited in the wild.
How severe is CVE-2026-65829?
Medium severity, with a CVSS score of 5.3, published 22 September 2026.
Which products and versions are affected?
net.sf.mpxj:mpxj (Maven) >= 7.3.0, < 16.5.0, ECOSYSTEM:introduced=7.3.0,fixed=16.5.0; MPXJ.Net (NuGet) >= 7.3.0, < 16.5.0, ECOSYSTEM:introduced=7.3.0,fixed=16.5.0; net.sf.mpxj (NuGet) >= 7.3.0, < 16.5.0, ECOSYSTEM:introduced=7.3.0,fixed=16.5.0; net.sf.mpxj-for-csharp (NuGet) >= 7.3.0, < 16.5.0, ECOSYSTEM:introduced=7.3.0,fixed=16.5.0; and 3 more.
Is there a fix for CVE-2026-65829?
Yes. net.sf.mpxj:mpxj (Maven): upgrade to 16.5.0 or later; MPXJ.Net (NuGet): upgrade to 16.5.0 or later; net.sf.mpxj (NuGet): upgrade to 16.5.0 or later; net.sf.mpxj-for-csharp (NuGet): upgrade to 16.5.0 or later; net.sf.mpxj-for-vb (NuGet): upgrade to 16.5.0 or later; mpxj (PyPI): upgrade to 16.5.0 or later; mpxj (RubyGems): upgrade to 16.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65829 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-65829?
Check whether you run net.sf.mpxj:mpxj (Maven), MPXJ.Net (NuGet), net.sf.mpxj (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • net.sf.mpxj:mpxj (Maven): upgrade to 16.5.0 or later
    # set net.sf.mpxj:mpxj to 16.5.0 in your pom.xml or build.gradle
  • MPXJ.Net (NuGet): upgrade to 16.5.0 or later
    dotnet add package MPXJ.Net --version 16.5.0
  • net.sf.mpxj (NuGet): upgrade to 16.5.0 or later
    dotnet add package net.sf.mpxj --version 16.5.0
  • net.sf.mpxj-for-csharp (NuGet): upgrade to 16.5.0 or later
    dotnet add package net.sf.mpxj-for-csharp --version 16.5.0
  • net.sf.mpxj-for-vb (NuGet): upgrade to 16.5.0 or later
    dotnet add package net.sf.mpxj-for-vb --version 16.5.0
  • mpxj (PyPI): upgrade to 16.5.0 or later
    pip install "mpxj>=16.5.0"
  • mpxj (RubyGems): upgrade to 16.5.0 or later
    bundle update mpxj

Technical details

This is a path traversal vulnerability (CWE-22) in MPXJ's handling of Primavera P3 PRX and SureTrak STX file formats. The library fails to properly validate or sanitize file paths extracted from these project files, allowing an attacker to use path traversal sequences (e.g., ../) to write files outside the intended directory. The attack requires a network-reachable application that processes untrusted PRX or STX files; no authentication or user interaction beyond opening a malicious file is needed. Successful exploitation results in arbitrary file write capabilities on the target system. The vulnerability affects MPXJ versions 7.3.0 through 16.4.x across multiple language ecosystems (Java, .NET, Python, Ruby); version 16.5.0 and later contain the fix.

Affected products

  • MPXJ MPXJ.Net >= 7.3.0, < 16.5.0
  • MPXJ mpxj >= 7.3.0, < 16.5.0
  • MPXJ net.sf.mpxj >= 7.3.0, < 16.5.0
  • MPXJ net.sf.mpxj-for-csharp >= 7.3.0, < 16.5.0
  • MPXJ net.sf.mpxj-for-vb >= 7.3.0, < 16.5.0

Identifiers

  • CVE-2026-65829
  • GHSA-7952-gx68-cjqr
  • PYSEC-2026-4108

Timeline

  • 2026-07-03: disclosed
  • 2026-07-03: patched: Version 16.5.0 released with fix
  • 2026-09-22: advisory: Published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.