Read the docs
TI-2020-17989 Aliases CVE-2020-35460GHSA-p9j6-4pjr-gp48

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in…

Priority LOW 34CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01864 79th percentileScored 2026-11-07
Fix Fixed net.sf.mpxj:mpxj (Maven): 8.3.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—net.sf.mpxj:mpxj (Maven)before 8.3.58.3.5Patch availableGHSA-p9j6-4pjr-gp48
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • net.sf.mpxj:mpxj (Maven) Vendor— Affected before 8.3.5 Fixed in 8.3.5 Patch available GHSA-p9j6-4pjr-gp48

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:mpxj:mpxj:*:*:*:*:*:*:*:*before 8.3.5VulnerableMpxj
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.7 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*16.1VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*16.2VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*21.12VulnerableOracle
  • cpe:2.3:a:mpxj:mpxj:*:*:*:*:*:*:*:* Versions before 8.3.5 Vulnerable ·Mpxj
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* Versions 21.12 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-p9j6-4pjr-gp48 net.sf.mpxj:mpxj (Maven) Fixed in 8.3.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-35460
  2. 2026-10-03 Alias added: GHSA-p9j6-4pjr-gp48

References

Patch 2

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences