CVE-2026-65829 in Mpxj
Summary
by MITRE • 09/22/2026
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified within the MPXJ library, specifically affecting versions from 7.3.0 through 16.5.0, represents a critical path traversal and arbitrary file write flaw rooted in the parsing of legacy project management file formats. MPXJ is widely utilized by enterprise applications to ingest data from Primavera P3 PRX and SureTrak STX files, which are common standards for scheduling and resource planning in construction and engineering sectors. The core technical deficiency lies in how the library processes internal references or embedded paths within these specific binary structures. When a maliciously crafted file is supplied as input, the parser fails to adequately sanitize path components contained within the project data structure. This lack of validation allows an attacker to inject directory traversal sequences that bypass intended output directories, effectively tricking the application into writing files to arbitrary locations on the host filesystem where the MPXJ library is executing.
From a technical perspective, this flaw aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-436: Interpretation Conflict. The vulnerability exploits the trust placed in file formats that are often processed automatically by backend services without rigorous inspection. By manipulating internal pointers or metadata fields within the PRX or STX files, an attacker can direct the write operation outside the sandboxed or expected output folder. This capability transforms a simple data ingestion process into a mechanism for arbitrary filesystem manipulation. The severity of this issue is amplified because project management tools are often integrated with broader enterprise systems that may have elevated privileges to ensure seamless workflow automation and database synchronization.
The operational impact of this vulnerability extends beyond mere file system corruption or unauthorized writes. An attacker who can write files to specific, predictable locations on the server could achieve remote code execution if they target executable directories such as web roots, temporary script folders, or application deployment paths. For instance, writing a malicious shell script or compiled binary to a location that is subsequently executed by the hosting environment would grant full control over the underlying operating system. Even without direct code execution, this vulnerability can be leveraged for denial of service attacks by filling up critical disk partitions with junk data, or for privilege escalation if files are written into configuration directories that alter application behavior upon restart. In cloud-native environments where MPXJ might run within containers, successful exploitation could potentially aid in container escape scenarios depending on the volume mounts and security contexts configured.
This vulnerability is also relevant to the MITRE ATT&CK framework under techniques such as T1059 Command and Scripting Interpreter if used for execution, or more broadly under Initial Access and Persistence vectors where crafted files serve as the delivery mechanism. The lack of input validation on file paths extracted from external sources highlights a common oversight in libraries designed for high-throughput data processing. Organizations relying on MPXJ versions prior to 16.5.0 are at significant risk, particularly those that accept project plan uploads from untrusted or semi-trusted users via web interfaces or API endpoints.
To mitigate this vulnerability, immediate action is required to upgrade the MPXJ library to version 16.5.0 or later, where the path traversal logic has been corrected and strict validation of output destinations is enforced. For environments that cannot immediately patch due to dependency constraints, defensive coding practices should be implemented at the application layer. This includes implementing allow-lists for file paths, ensuring all write operations are confined to a designated temporary directory using canonicalization checks before any I/O operation occurs, and validating the content of uploaded files against known malicious patterns or structural anomalies specific to PRX and STX formats. Additionally, running applications with least privilege principles ensures that even if an arbitrary write is successful, the attacker cannot modify critical system binaries or configuration files outside their designated scope. Regular security audits of third-party library usage are essential to prevent similar path traversal issues in other components of the software supply chain.