MPXJ has a Potential Path Traversal Vulnerability
Priority LOW 31CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00481 41st percentileScored 2026-11-07
Fix Fixed mpxj (joniles): 13.5.1net.sf.mpxj:mpxj (Maven): 13.5.1+6 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| joniles | mpxj | 8.3.5 to before 13.5.1 | 13.5.1 | Patch available | CNA |
| — | net.sf.mpxj:mpxj (Maven) | 8.3.5 to before 13.5.1 | 13.5.1 | Patch available | GHSA-j945-c44v-97g6 |
| — | mpxj (RubyGems) | 8.3.5 to before 13.5.1 | 13.5.1 | Patch available | GHSA-j945-c44v-97g6 |
| — | mpxj (PyPI) | 8.3.5 to before 13.5.1 | 13.5.1 | Patch available | GHSA-j945-c44v-97g6 |
| — | net.sf.mpxj (NuGet) | 8.3.5 to before 13.5.1 | 13.5.1 | Patch available | GHSA-j945-c44v-97g6 |
| — | net.sf.mpxj-for-csharp (NuGet) | 8.3.5 to before 13.5.1 | 13.5.1 | Patch available | GHSA-j945-c44v-97g6 |
| — | net.sf.mpxj-for-vb (NuGet) | 8.3.5 to before 13.5.1 | 13.5.1 | Patch available | GHSA-j945-c44v-97g6 |
| — | MPXJ.Net (NuGet) | 13.0.0 to before 13.5.1 | 13.5.1 | Patch available | GHSA-j945-c44v-97g6 |
- mpxj Vendorjoniles Affected 8.3.5 to before 13.5.1 Fixed in 13.5.1 Patch available CNA
- net.sf.mpxj:mpxj (Maven) Vendor— Affected 8.3.5 to before 13.5.1 Fixed in 13.5.1 Patch available GHSA-j945-c44v-97g6
- mpxj (RubyGems) Vendor— Affected 8.3.5 to before 13.5.1 Fixed in 13.5.1 Patch available GHSA-j945-c44v-97g6
- mpxj (PyPI) Vendor— Affected 8.3.5 to before 13.5.1 Fixed in 13.5.1 Patch available GHSA-j945-c44v-97g6
- net.sf.mpxj (NuGet) Vendor— Affected 8.3.5 to before 13.5.1 Fixed in 13.5.1 Patch available GHSA-j945-c44v-97g6
- net.sf.mpxj-for-csharp (NuGet) Vendor— Affected 8.3.5 to before 13.5.1 Fixed in 13.5.1 Patch available GHSA-j945-c44v-97g6
- net.sf.mpxj-for-vb (NuGet) Vendor— Affected 8.3.5 to before 13.5.1 Fixed in 13.5.1 Patch available GHSA-j945-c44v-97g6
- MPXJ.Net (NuGet) Vendor— Affected 13.0.0 to before 13.5.1 Fixed in 13.5.1 Patch available GHSA-j945-c44v-97g6
Remediation
- Fix · CNA mpxj (joniles) Fixed in 13.5.1
- Fix · GHSA-j945-c44v-97g6 net.sf.mpxj:mpxj (Maven) Fixed in 13.5.1 Advisory →
- Fix · GHSA-j945-c44v-97g6 mpxj (RubyGems) Fixed in 13.5.1 Advisory →
- Fix · GHSA-j945-c44v-97g6 mpxj (PyPI) Fixed in 13.5.1 Advisory →
- Fix · GHSA-j945-c44v-97g6 net.sf.mpxj (NuGet) Fixed in 13.5.1 Advisory →
- Fix · GHSA-j945-c44v-97g6 net.sf.mpxj-for-csharp (NuGet) Fixed in 13.5.1 Advisory →
- Fix · GHSA-j945-c44v-97g6 net.sf.mpxj-for-vb (NuGet) Fixed in 13.5.1 Advisory →
- Fix · GHSA-j945-c44v-97g6 MPXJ.Net (NuGet) Fixed in 13.5.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-49771
- 2026-10-03 Alias added: GHSA-j945-c44v-97g6
References
More joniles vulnerabilities
- TI-2026-44114 MPXJ: XXE Vulnerability in MerlinReader CVSS 3.1HIGH 7.5
- TI-2026-46908 MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-49771 · CVE Program
- CVE-2024-49771 · NVD
- FIRST EPSS
- GHSA-j945-c44v-97g6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences