CVE-2026-65829

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65829
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65829.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65829
Aliases
Published
2026-09-22T19:54:19Z
Modified
2026-09-23T11:45:15Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
Details

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65829.json"
}
References

Affected packages

Git / github.com/joniles/mpxj

Affected ranges

Type
GIT
Repo
https://github.com/joniles/mpxj
Events
Introduced
6c091eee2ed6f8f574989b27bed9b4e050560240
Fixed
e38ce68492714049db201c6cf2de785e52f1c1cc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "7.3.0"
        },
        {
            "fixed":  "16.5.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v10.*
v10.0.0
v10.0.1
v10.0.2
v10.0.3
v10.0.4
v10.0.5
v10.1.0
v10.10.0
v10.12.0
v10.13.0
v10.14.1
v10.15.0
v10.16.1
v10.16.2
v10.2.0
v10.3.0
v10.4.0
v10.5.0
v10.6.0
v10.6.1
v10.6.2
v10.7.0
v10.8.0
v10.9.0
v10.9.1
v11.*
v11.0.0
v11.1.0
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.4.0
v11.5.0
v11.5.1
v11.5.2
v11.5.3
v11.5.4
v12.*
v12.0.0
v12.0.1
v12.0.2
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.10.0
v12.10.1
v12.10.2
v12.10.3
v12.2.0
v12.3.0
v12.5.0
v12.6.0
v12.7.0
v12.8.0
v12.8.1
v12.9.1
v12.9.2
v12.9.3
v13.*
v13.0.0
v13.0.1
v13.0.2
v13.1.0
v13.10.0
v13.11.0
v13.12.0
v13.2.0
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.2
v13.5.1
v13.6.0
v13.7.0
v13.8.0
v13.9.0
v14.*
v14.0.0
v14.1.0
v14.2.0
v14.3.0
v14.3.1
v14.3.2
v14.3.3
v14.3.4
v14.3.5
v14.5.0
v14.5.1
v14.5.2
v15.*
v15.0.0
v15.1.0
v15.2.0
v15.3.0
v15.3.1
v16.*
v16.0.0
v16.1.0
v16.2.0
v16.3.0
v16.4.0
v7.*
v7.3.0
v7.4.0
v7.4.1
v7.4.2
v7.4.3
v7.4.4
v7.5.0
v7.6.0
v7.6.1
v7.6.2
v7.6.3
v7.7.0
v7.7.1
v7.8.0
v7.8.1
v7.8.2
v7.8.3
v7.8.4
v7.9.0
v7.9.1
v7.9.2
v7.9.3
v7.9.4
v7.9.5
v7.9.6
v7.9.7
v7.9.8
v8.*
v8.0.0
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.0.6
v8.0.7
v8.0.8
v8.1.0
v8.1.1
v8.1.2
v8.1.3
v8.1.4
v8.2.0
v8.3.0
v8.3.1
v8.3.2
v8.3.3
v8.3.4
v8.3.5
v8.4.0
v8.5.0
v8.5.1
v9.*
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.2.2
v9.2.3
v9.2.4
v9.2.5
v9.2.6
v9.3.0
v9.3.1
v9.4.0
v9.5.0
v9.5.1
v9.5.2
v9.6.0
v9.7.0
v9.8.0
v9.8.1
v9.8.2
v9.8.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65829.json"