CVE-2026-65829

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65829
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65829.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65829
Aliases
Published
2026-09-22T19:54:19Z
Modified
2026-10-01T17:56:20Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
Details

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65829.json"
}
References

Affected packages

Git / github.com/joniles/mpxj

Affected ranges

Type
GIT
Repo
https://github.com/joniles/mpxj
Events
Introduced
6c091eee2ed6f8f574989b27bed9b4e050560240
Fixed
4347315afab1ef5a2907978a754fbc5b0ff58e6f
Fixed
e38ce68492714049db201c6cf2de785e52f1c1cc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "7.3.0"
        },
        {
            "fixed":  "16.5.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v10.*
v10.0.0
v10.0.1
v10.0.2
v10.0.3
v10.0.4
v10.0.5
v10.1.0
v10.10.0
v10.12.0
v10.13.0
v10.14.1
v10.15.0
v10.16.1
v10.16.2
v10.2.0
v10.3.0
v10.4.0
v10.5.0
v10.6.0
v10.6.1
v10.6.2
v10.7.0
v10.8.0
v10.9.0
v10.9.1
v11.*
v11.0.0
v11.1.0
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.4.0
v11.5.0
v11.5.1
v11.5.2
v11.5.3
v11.5.4
v12.*
v12.0.0
v12.0.1
v12.0.2
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.10.0
v12.10.1
v12.10.2
v12.10.3
v12.2.0
v12.3.0
v12.5.0
v12.6.0
v12.7.0
v12.8.0
v12.8.1
v12.9.1
v12.9.2
v12.9.3
v13.*
v13.0.0
v13.0.1
v13.0.2
v13.1.0
v13.10.0
v13.11.0
v13.12.0
v13.2.0
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.2
v13.5.1
v13.6.0
v13.7.0
v13.8.0
v13.9.0
v14.*
v14.0.0
v14.1.0
v14.2.0
v14.3.0
v14.3.1
v14.3.2
v14.3.3
v14.3.4
v14.3.5
v14.5.0
v14.5.1
v14.5.2
v15.*
v15.0.0
v15.1.0
v15.2.0
v15.3.0
v15.3.1
v16.*
v16.0.0
v16.1.0
v16.2.0
v16.3.0
v16.4.0
v7.*
v7.3.0
v7.4.0
v7.4.1
v7.4.2
v7.4.3
v7.4.4
v7.5.0
v7.6.0
v7.6.1
v7.6.2
v7.6.3
v7.7.0
v7.7.1
v7.8.0
v7.8.1
v7.8.2
v7.8.3
v7.8.4
v7.9.0
v7.9.1
v7.9.2
v7.9.3
v7.9.4
v7.9.5
v7.9.6
v7.9.7
v7.9.8
v8.*
v8.0.0
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.0.6
v8.0.7
v8.0.8
v8.1.0
v8.1.1
v8.1.2
v8.1.3
v8.1.4
v8.2.0
v8.3.0
v8.3.1
v8.3.2
v8.3.3
v8.3.4
v8.3.5
v8.4.0
v8.5.0
v8.5.1
v9.*
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.2.2
v9.2.3
v9.2.4
v9.2.5
v9.2.6
v9.3.0
v9.3.1
v9.4.0
v9.5.0
v9.5.1
v9.5.2
v9.6.0
v9.7.0
v9.8.0
v9.8.1
v9.8.2
v9.8.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65829.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "26137294919212558646217543775357139077",
            "length":  582
        },
        "id":  "CVE-2026-65829-1d2fa5d4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f",
        "target":  {
            "file":  "src/main/java/org/mpxj/primavera/p3/P3PRXFileReader.java",
            "function":  "extractFile"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "303990464396141211619784831390401391569",
                "165861617335706445512477238489589254740",
                "70085124622289296690162441341578163550",
                "230817906470224154170436901765390098942"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-65829-294129d7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f",
        "target":  {
            "file":  "src/main/java/org/mpxj/primavera/suretrak/SureTrakSTXFileReader.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "130986766014249640074125723408338597297",
            "length":  768
        },
        "id":  "CVE-2026-65829-a5e65f48",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f",
        "target":  {
            "file":  "src/main/java/org/mpxj/common/InputStreamHelper.java",
            "function":  "processZipStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "260855502530372066774334199286537043764",
                "165861617335706445512477238489589254740",
                "70085124622289296690162441341578163550",
                "230817906470224154170436901765390098942"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-65829-b99582e4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f",
        "target":  {
            "file":  "src/main/java/org/mpxj/primavera/p3/P3PRXFileReader.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "164524440702400672968380434327299917033",
                "325320645547774970919948907018940888476"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-65829-ba91353e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f",
        "target":  {
            "file":  "src/main/java/org/mpxj/common/FileHelper.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "220869360923207429249635093212965584954",
            "length":  583
        },
        "id":  "CVE-2026-65829-bfd36b3b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f",
        "target":  {
            "file":  "src/main/java/org/mpxj/primavera/suretrak/SureTrakSTXFileReader.java",
            "function":  "extractFile"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "81979156390207862234267613007584960436",
                "239266120748964787801676303822309401293",
                "297414599188669985409783645092954694125",
                "187611314904718057340243502697188224700",
                "23823698038740161669005166799990125011",
                "124035711461920779839948435294902243910",
                "204499729709324372219157611269517506396"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-65829-e145f38a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f",
        "target":  {
            "file":  "src/main/java/org/mpxj/common/InputStreamHelper.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-25T08:27:40Z"