CVE-2026-61570: MPXJ Library XXE Vulnerability

CVE-2026-61570 Overview

CVE-2026-61570 is an XML External Entity (XXE) vulnerability [CWE-611] in MPXJ, an open source Java library that reads and writes project plans across multiple file formats and databases. The flaw affects the MerlinReader component in versions from 5.5.5 through 16.4.0. MerlinReader instantiates a DocumentBuilder with default settings when parsing XML retrieved from the ZTIMEINTERVALS column of a Merlin project SQLite database. Doctype declarations and external entity resolution remain enabled. A crafted database can direct the parser to read arbitrary local files. MPXJ's downstream handling of the parsed XML makes disclosure of file contents unlikely, limiting impact primarily to file access rather than exfiltration. Version 16.4.1 fixes the issue.

Critical Impact
An attacker supplying a malicious Merlin SQLite database can force the parser to access arbitrary local files on the host running MPXJ.

Affected Products

MPXJ versions 5.5.5 through 16.4.0
Java applications embedding MPXJ's MerlinReader for Merlin project file ingestion
Downstream project management tooling built on the vulnerable MPXJ releases

Discovery Timeline

2026-09-22 - CVE-2026-61570 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61570

Vulnerability Analysis

The vulnerability resides in MerlinReader, which processes XML content stored inside a Merlin project's SQLite database. MerlinReader obtains XML from the ZTIMEINTERVALS column and hands it to a DocumentBuilder produced by an unconfigured DocumentBuilderFactory. Because the factory retains default JAXP behavior, the resulting parser accepts DOCTYPE declarations and resolves external entities. An attacker who controls the database contents can define an external entity that references a local file path (for example, file:///etc/passwd) and cause the parser to fetch that resource during parsing. The impact is scoped to confidentiality of local file access; MPXJ does not surface the parsed XML back to the caller, which limits practical data exfiltration through the classic XXE pattern.

Root Cause

The root cause is missing hardening on the JAXP DocumentBuilderFactory used by MerlinReader. Secure defaults such as FEATURE_SECURE_PROCESSING, disallow-doctype-decl, and disabling external-general-entities and external-parameter-entities were not applied before building the DocumentBuilder.

Attack Vector

Exploitation requires the victim application to parse an attacker-supplied or attacker-modified Merlin .sqlite project database. The attacker injects a crafted XML payload with an external entity reference into the ZTIMEINTERVALS column. When MerlinReader parses that column, the underlying XML parser resolves the entity and issues a filesystem read against the target path.

java

// Source: https://github.com/joniles/mpxj/commit/6e8288bc4d1cd62842af298004dc74fe66fb0805
// Patch excerpt: src/main/java/org/mpxj/merlin/MerlinReader.java
 import java.util.Map;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.xpath.XPath;
 import javax.xml.xpath.XPathConstants;
 import javax.xml.xpath.XPathExpression;

The patch removes the direct DocumentBuilderFactory usage from MerlinReader and centralizes secure DocumentBuilder construction in UnmarshalHelper, where secure processing features are applied consistently. See the GitHub Security Advisory GHSA-5vvx-3h34-f3gj for full advisory details.

Detection Methods for CVE-2026-61570

Indicators of Compromise

Merlin .sqlite project files whose ZTIMEINTERVALS column contains <!DOCTYPE, <!ENTITY, or SYSTEM references.
Outbound network connections or local file reads originating from Java processes shortly after MPXJ parses a Merlin database.
Unexpected access to sensitive paths (for example, /etc/passwd, C:\Windows\win.ini) by services that embed MPXJ.

Detection Strategies

Inspect ingested Merlin databases for XML payloads containing DOCTYPE or external entity declarations before handing them to MPXJ.
Enable Java -Djavax.xml.accessExternalDTD= and -Djavax.xml.accessExternalSchema= restrictions and log violations produced by the JAXP layer.
Correlate MerlinReader invocation stack traces with subsequent filesystem or network activity from the same JVM.

Monitoring Recommendations

Alert on Java application processes that read files outside their expected working directory following project file imports.
Monitor egress from application servers that process third-party project files, particularly to internal-only IP ranges.
Track MPXJ library versions across build artifacts and container images to identify hosts still running versions below 16.4.1.

How to Mitigate CVE-2026-61570

Immediate Actions Required

Upgrade MPXJ to version 16.4.1 or later across all applications and build pipelines that consume Merlin databases.
Reject or quarantine Merlin .sqlite files from untrusted sources until the upgrade is deployed.
Audit dependency manifests (pom.xml, build.gradle) for transitive references to affected MPXJ versions.

Patch Information

The fix is available in MPXJ v16.4.1. The corrective commit 6e8288b removes direct DocumentBuilderFactory instantiation from MerlinReader and routes XML parsing through UnmarshalHelper, which applies secure XML processing configuration.

Workarounds

Wrap MerlinReader calls behind a sandboxed process with no filesystem or network access beyond the input file.
Pre-scan the ZTIMEINTERVALS column of incoming Merlin databases and strip DOCTYPE or external entity declarations before parsing.
Restrict the JVM's FilePermission and SocketPermission for services that must process untrusted project files.

bash

# Update Maven dependency to the patched release
mvn versions:use-dep-version -Dincludes=org.mpxj:mpxj -DdepVersion=16.4.1 -DforceVersion=true

# Verify the resolved version
mvn dependency:tree -Dincludes=org.mpxj:mpxj