CVE-2026-61570 in Mpxj
Summary
by MITRE • 09/22/2026
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ's subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified within the MPXJ library affects versions ranging from 5.5.5 through 16.4.1, specifically impacting the MerlinReader component responsible for parsing project plans stored in SQLite databases using the ZTIMEINTERVALS column format. This issue stems from an insecure configuration of the underlying XML parser used during the reading process. When MPXJ processes a maliciously crafted database file containing specific XML structures within this column, it instantiates a DocumentBuilder with default settings that do not adequately restrict dangerous parsing features. Specifically, the parser leaves document type declarations and external entity resolution enabled by default. This configuration allows an attacker to exploit Server-Side Request Forgery mechanisms inherent in XML parsers, commonly referred to as XML External Entity injection or XXE attacks.
The technical flaw lies in the failure to disable support for DOCTYPE declarations and external entities when parsing untrusted input from SQLite databases. In standard secure coding practices, XML parsers should be configured with features such as disallowing doctype declarations and disabling external general entities to prevent attackers from injecting malicious entity definitions that reference local or remote resources. By leaving these features active, the library permits an attacker to define a custom entity within the ZTIMEINTERVALS column that points to arbitrary files on the host system's file path. When the parser processes this crafted input, it attempts to resolve and read the contents of the specified local file as part of the XML document structure. This behavior aligns with CWE-611, which describes Improper Restriction of XML External Entity Reference vulnerabilities where an application allows external entities to be resolved during parsing without sufficient validation or restriction.
From a threat intelligence perspective, this vulnerability maps directly to the MITRE ATT&CK technique T1572, which covers Protocol Tunneling and specifically relates to exploiting protocol features for unauthorized access or data exfiltration via XML-based protocols. The operational impact of this flaw is primarily centered on potential information disclosure through local file read capabilities. An attacker who can supply a crafted SQLite database containing the malicious ZTIMEINTERVALS payload could force the application running MPXJ to read sensitive files from the server's filesystem, such as configuration files, source code, or other data accessible by the user account executing the Java process. However, it is critical to note that while the parser successfully reads the file contents into memory during the parsing phase, the subsequent handling of this parsed XML within MPXJ’s architecture makes actual disclosure of these file contents unlikely in most standard usage scenarios. The library typically processes project data structures rather than exposing raw XML content directly to end-users or network interfaces, which significantly mitigates the risk of direct data leakage despite the successful execution of the local file read operation.
To mitigate this vulnerability and prevent similar issues in future implementations, it is essential to configure XML parsers with secure defaults that explicitly disable external entity resolution and DOCTYPE processing. Developers should utilize factory methods such as setFeature on DocumentBuilderFactory instances to enforce restrictions like disallowing doctype declarations and disabling access to external general entities before parsing any untrusted input. For organizations currently using affected versions of MPXJ, the recommended remediation is to upgrade immediately to version 16.4.1 or later, where this insecure configuration has been corrected. Additionally, implementing strict input validation on all data sources feeding into XML parsers and employing allowlists for expected file formats can provide defense-in-depth against such injection attacks. Security teams should also audit other components within their application stack that utilize MPXJ to ensure no custom configurations override the secure defaults introduced in the patched version.