Executive brief
MPXJ is a project management library used to read and process files from Microsoft Project, Primavera, and other scheduling tools. A path traversal vulnerability allows attackers to write arbitrary files to any location on the file system when processing specially crafted PRX or STX project files, potentially enabling code execution or data destruction.
Technical details
This is a path traversal vulnerability (CWE-22) in MPXJ's handling of Primavera P3 PRX and SureTrak STX file formats. The library fails to properly validate or sanitize file paths extracted from these project files, allowing an attacker to use path traversal sequences (e.g., ../) to write files outside the intended directory. The attack requires a network-reachable application that processes untrusted PRX or STX files; no authentication or user interaction beyond opening a malicious file is needed. Successful exploitation results in arbitrary file write capabilities on the target system. The vulnerability affects MPXJ versions 7.3.0 through 16.4.x across multiple language ecosystems (Java, .NET, Python, Ruby); version 16.5.0 and later contain the fix.
Affected products
- MPXJ MPXJ.Net >= 7.3.0, < 16.5.0
- MPXJ mpxj >= 7.3.0, < 16.5.0
- MPXJ net.sf.mpxj >= 7.3.0, < 16.5.0
- MPXJ net.sf.mpxj-for-csharp >= 7.3.0, < 16.5.0
- MPXJ net.sf.mpxj-for-vb >= 7.3.0, < 16.5.0
Timeline
- 2026-07-03: disclosed
- 2026-07-03: patched: Version 16.5.0 released with fix
- 2026-09-22: advisory: Published to GitHub Advisory Database