CVE-2026-65829
CVE-2026-65829 · MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
This page contains facts from public vulnerability sources. Check the original advisory before updating.
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.
CVSS 5.3 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
mpxj
- Versions
- >= 7.3.0, < 16.5.0: Affected
No fix published
mpxj.net NuGet
- Versions
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.10.0
- 13.11.0
- 13.12.0
- 13.2.0
- 13.2.1
- 13.2.2
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
- 13.5.1
- 13.6.0
- 13.8.0
- 13.9.0
- 14.0.0
- 14.1.0
- 14.2.0
- 14.3.0
- 14.3.1
- 14.3.2
- 14.3.3
- 14.3.4
- 14.3.5
- 14.4.0
- 14.5.0
- 14.5.1
- 14.5.2
- 15.0.0
- 15.1.0
- 15.2.0
- 15.3.0
- 15.3.1
- 16.0.0
- 16.1.0
- 16.2.0
- 16.3.0
- 16.4.0
- 16.4.1
- Affected ranges
- ECOSYSTEM: ≥ 7.3.0, < 16.5.0
Update to 16.5.0
mpxj RubyGems
- Versions
- 10.0.0
- 10.0.1
- 10.0.2
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.0
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.10.0
- 13.11.0
- 13.12.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.5.0
- 13.5.1
- 13.6.0
- 13.7.0
- 13.8.0
- 13.9.0
- 14.0.0
- 14.1.0
- 14.2.0
- 14.3.0
- 14.3.1
- 14.3.2
- 14.3.3
- 14.3.4
- 14.3.5
- 14.4.0
- 14.5.0
- 14.5.1
- 14.5.2
- 15.0.0
- 15.1.0
- 15.2.0
- 15.3.0
- 15.3.1
- 16.0.0
- 16.1.0
- 16.2.0
- 16.3.0
- 16.4.0
- 16.4.1
- 7.3.0
- 7.4.0
- 7.4.1
- 7.4.2
- 7.4.3
- 7.4.4
- 7.5.0
- 7.6.0
- 7.6.1
- 7.6.2
- 7.6.3
- 7.7.0
- 7.7.1
- 7.8.0
- 7.8.1
- 7.8.2
- 7.8.3
- 7.8.4
- 7.9.0
- 7.9.1
- 7.9.2
- 7.9.3
- 7.9.4
- 7.9.5
- 7.9.6
- 7.9.7
- 7.9.8
- 8.0.0
- 8.0.2
- 8.0.3
- 8.0.4
- 8.0.5
- 8.0.6
- 8.0.7
- 8.0.8
- 8.1.0
- 8.1.1
- 8.1.2
- 8.1.3
- 8.1.4
- 8.2.0
- 8.3.0
- 8.3.1
- 8.3.2
- 8.3.3
- 8.3.4
- 8.3.5
- 8.4.0
- 8.5.0
- 8.5.1
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
- Affected ranges
- ECOSYSTEM: ≥ 7.3.0, < 16.5.0
Update to 16.5.0
mpxj PyPI
- Versions
- 10.0.0
- 10.0.1
- 10.0.2
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.10.0
- 13.11.0
- 13.12.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
- 13.5.1
- 13.6.0
- 13.7.0
- 13.8.0
- 13.9.0
- 14.0.0
- 14.1.0
- 14.2.0
- 14.3.0
- 14.3.1
- 14.3.2
- 14.3.3
- 14.3.4
- 14.3.5
- 14.4.0
- 14.5.0
- 14.5.1
- 14.5.2
- 15.0.0
- 15.1.0
- 15.2.0
- 15.3.0
- 15.3.1
- 16.0.0
- 16.1.0
- 16.2.0
- 16.3.0
- 16.4.0
- 16.4.1
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
- Affected ranges
- ECOSYSTEM: ≥ 7.3.0, < 16.5.0
Update to 16.5.0
net.sf.mpxj NuGet
- Versions
- 10.0.0
- 10.0.1
- 10.0.2
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.0
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.10.0
- 13.11.0
- 13.12.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
- 13.5.1
- 13.6.0
- 13.7.0
- 13.8.0
- 13.9.0
- 7.3.0
- 7.4.0
- 7.4.1
- 7.4.2
- 7.4.3
- 7.4.4
- 7.5.0
- 7.6.0
- 7.6.1
- 7.6.2
- 7.6.3
- 7.7.0
- 7.7.1
- 7.8.0
- 7.8.1
- 7.8.2
- 7.8.3
- 7.8.4
- 7.9.0
- 7.9.1
- 7.9.2
- 7.9.3
- 7.9.4
- 7.9.5
- 7.9.7
- 7.9.8
- 8.0.0
- 8.0.1
- 8.0.2
- 8.0.3
- 8.0.4
- 8.0.5
- 8.0.6
- 8.0.8
- 8.1.0
- 8.1.1
- 8.1.2
- 8.1.3
- 8.1.4
- 8.2.0
- 8.3.0
- 8.3.1
- 8.3.2
- 8.3.3
- 8.3.4
- 8.3.5
- 8.4.0
- 8.5.0
- 8.5.1
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
- Affected ranges
- ECOSYSTEM: ≥ 7.3.0, < 16.5.0
Update to 16.5.0
net.sf.mpxj-for-csharp NuGet
- Versions
- 10.0.0
- 10.0.1
- 10.0.2
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.0
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.10.0
- 13.11.0
- 13.12.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
- 13.5.1
- 13.6.0
- 13.7.0
- 13.8.0
- 13.9.0
- 7.3.0
- 7.4.0
- 7.4.1
- 7.4.2
- 7.4.3
- 7.4.4
- 7.5.0
- 7.6.0
- 7.6.1
- 7.6.2
- 7.6.3
- 7.7.0
- 7.7.1
- 7.8.0
- 7.8.1
- 7.8.2
- 7.8.3
- 7.8.4
- 7.9.0
- 7.9.1
- 7.9.2
- 7.9.3
- 7.9.4
- 7.9.5
- 7.9.7
- 7.9.8
- 8.0.0
- 8.0.1
- 8.0.2
- 8.0.3
- 8.0.4
- 8.0.5
- 8.0.6
- 8.0.8
- 8.1.0
- 8.1.1
- 8.1.2
- 8.1.3
- 8.1.4
- 8.2.0
- 8.3.0
- 8.3.1
- 8.3.2
- 8.3.3
- 8.3.4
- 8.3.5
- 8.4.0
- 8.5.0
- 8.5.1
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
- Affected ranges
- ECOSYSTEM: ≥ 7.3.0, < 16.5.0
Update to 16.5.0
net.sf.mpxj-for-vb NuGet
- Versions
- 10.0.0
- 10.0.1
- 10.0.2
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.0
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.10.0
- 13.11.0
- 13.12.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
- 13.5.1
- 13.6.0
- 13.7.0
- 13.8.0
- 13.9.0
- 7.3.0
- 7.4.0
- 7.4.1
- 7.4.2
- 7.4.3
- 7.4.4
- 7.5.0
- 7.6.0
- 7.6.1
- 7.6.2
- 7.6.3
- 7.7.0
- 7.7.1
- 7.8.0
- 7.8.1
- 7.8.2
- 7.8.3
- 7.8.4
- 7.9.0
- 7.9.1
- 7.9.2
- 7.9.3
- 7.9.4
- 7.9.5
- 7.9.7
- 7.9.8
- 8.0.0
- 8.0.1
- 8.0.2
- 8.0.3
- 8.0.4
- 8.0.5
- 8.0.6
- 8.0.8
- 8.1.0
- 8.1.1
- 8.1.2
- 8.1.3
- 8.1.4
- 8.2.0
- 8.3.0
- 8.3.1
- 8.3.2
- 8.3.3
- 8.3.4
- 8.3.5
- 8.4.0
- 8.5.0
- 8.5.1
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
- Affected ranges
- ECOSYSTEM: ≥ 7.3.0, < 16.5.0
Update to 16.5.0
net.sf.mpxj:mpxj Maven
- Versions
- 10.0.0
- 10.0.1
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.0
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.10.0
- 13.11.0
- 13.12.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
- 13.5.1
- 13.6.0
- 13.7.0
- 13.8.0
- 13.9.0
- 14.0.0
- 14.1.0
- 14.2.0
- 14.3.0
- 14.3.1
- 14.3.2
- 14.3.3
- 14.3.4
- 14.3.5
- 14.4.0
- 14.5.0
- 14.5.1
- 14.5.2
- 15.0.0
- 15.1.0
- 15.2.0
- 15.3.0
- 15.3.1
- 16.0.0
- 16.1.0
- 16.2.0
- 16.3.0
- 16.4.0
- 16.4.1
- 7.3.0
- 7.4.0
- 7.4.1
- 7.4.2
- 7.4.3
- 7.4.4
- 7.5.0
- 7.6.0
- 7.6.1
- 7.6.2
- 7.6.3
- 7.7.0
- 7.7.1
- 7.8.0
- 7.8.1
- 7.8.2
- 7.8.3
- 7.8.4
- 7.9.0
- 7.9.1
- 7.9.2
- 7.9.3
- 7.9.4
- 7.9.5
- 7.9.7
- 7.9.8
- 8.0.0
- 8.0.2
- 8.0.3
- 8.0.4
- 8.0.5
- 8.0.6
- 8.0.7
- 8.0.8
- 8.1.0
- 8.1.1
- 8.1.2
- 8.1.3
- 8.1.4
- 8.2.0
- 8.3.0
- 8.3.1
- 8.3.2
- 8.3.3
- 8.3.4
- 8.3.5
- 8.4.0
- 8.5.0
- 8.5.1
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
- Affected ranges
- ECOSYSTEM: ≥ 7.3.0, < 16.5.0
Update to 16.5.0