CVE-2026-65829: MPXJ Library Path Traversal Vulnerability

CVE-2026-65829 Overview

CVE-2026-65829 is a path traversal vulnerability [CWE-22] in MPXJ, an open source Java library for reading and writing project plans across multiple file formats and databases. The flaw affects MPXJ versions 7.3.0 through 16.4.x. Reading a crafted Primavera P3 PRX or SureTrak STX file causes MPXJ to write extracted archive contents to arbitrary locations on the filesystem. The library resolves entry paths without validating that the destination stays within the intended extraction directory. Version 16.5.0 fixes the issue.

Critical Impact
Applications that use MPXJ to parse untrusted PRX or STX files can be coerced into writing attacker-controlled files anywhere the application process has write access, enabling file overwrites and potential downstream code execution.

Affected Products

MPXJ versions 7.3.0 through 16.4.x
Applications embedding MPXJ for Primavera P3 (PRX) file parsing
Applications embedding MPXJ for SureTrak (STX) file parsing

Discovery Timeline

2026-09-22 - CVE-2026-65829 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-65829

Vulnerability Analysis

MPXJ handles Primavera P3 PRX and SureTrak STX files as compound archives. Parsing these formats requires expanding embedded entries to temporary files on disk. The archive expansion routine trusted the entry names inside the input file and constructed output paths without checking whether the resulting path escaped the intended parent directory.

An entry whose name contains ../ sequences or an absolute path resolves outside the extraction root. When MPXJ writes the entry, the JVM follows the traversal and creates or overwrites a file at the attacker-chosen location. The scope is limited to integrity because the attacker controls the write destination but not arbitrary read primitives.

Downstream impact depends on the host application. Overwriting scheduled task definitions, cron entries, web shells in served directories, or library files that the process later loads can escalate the flaw to code execution in some deployments.

Root Cause

The root cause is missing canonical path validation in the archive expansion helper inside FileHelper.java. Before the fix, extracted files were opened by concatenating the parent directory with the raw entry name. There was no comparison between the canonical parent path and the canonical target path, which is the standard defense against Zip Slip style traversal.

Attack Vector

The attacker delivers a malicious .PRX or .STX file to any application that calls MPXJ readers on untrusted input. This includes project management portals, batch importers, and CI pipelines that ingest schedule files. No authentication or user interaction beyond opening the file is required by the library itself.

java

// Fix from src/main/java/org/mpxj/common/FileHelper.java (v16.5.0)
// Source: https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f

/**
 * Ensures that the target file is within the parent directory.
 * Throws an exception if this is not the case.
 * Used to avoid CWE-22: Improper Limitation of a Pathname to a Restricted Directory
 * vulnerabilities when expanding file archives.
 *
 * @param parentDirectory parent directory
 * @param targetFile target file
 */
public static void validateTargetFileIsInParentDirectory(File parentDirectory, File targetFile) throws IOException
{
   if (!targetFile.getCanonicalFile().toPath().startsWith(parentDirectory.getCanonicalFile().toPath()))
   {
      throw new IOException("Entry is outside of the target dir: " + targetFile.getName());
   }
}

The patch introduces a canonical-path check invoked before each write during PRX and STX expansion. See the GitHub Security Advisory GHSA-7952-gx68-cjqr for the full advisory.

Detection Methods for CVE-2026-65829

Indicators of Compromise

Unexpected files created outside the application's temporary or working directory shortly after MPXJ ingests a PRX or STX file.
Modifications to system paths, startup scripts, or web root directories by the process hosting MPXJ.
Java stack traces referencing FileHelper write operations with paths containing ../ or absolute prefixes.

Detection Strategies

Inventory Java applications and dependencies to identify MPXJ versions between 7.3.0 and 16.4.x using software composition analysis.
Monitor process behavior for file writes by MPXJ-hosting processes to directories outside their declared working areas.
Inspect archived PRX and STX samples for entry names containing traversal sequences before ingestion.

Monitoring Recommendations

Enable file integrity monitoring on system directories, web roots, and scheduled task locations that could be targeted by a traversal write.
Log all invocations of MPXJ reader classes together with the source path of the input file for forensic replay.
Alert when the application process writes to paths outside an allowlist during PRX or STX parsing.

How to Mitigate CVE-2026-65829

Immediate Actions Required

Upgrade MPXJ to version 16.5.0 or later in all applications and build pipelines.
Audit ingestion workflows that accept PRX or STX files from external users and quarantine untrusted samples until the upgrade is confirmed.
Rebuild and redeploy any container images or fat JARs that bundle a vulnerable MPXJ version.

Patch Information

The fix is available in MPXJ Release v16.5.0. The change is implemented in commit 4347315, which adds validateTargetFileIsInParentDirectory in FileHelper.java and calls it during PRX and STX archive expansion.

Workarounds

Disable PRX and SureTrak STX ingestion paths until the library upgrade is deployed.
Run the MPXJ-hosting process under a least-privileged account with write access restricted to a dedicated working directory.
Execute untrusted file parsing inside an isolated sandbox or container with a read-only root filesystem.

bash

# Maven: pin MPXJ to the patched release
mvn versions:use-dep-version -Dincludes=net.sf.mpxj:mpxj -DdepVersion=16.5.0 -DforceVersion=true

# Gradle: enforce the patched version
# build.gradle
# dependencies {
#     implementation('net.sf.mpxj:mpxj') {
#         version { strictly '16.5.0' }
#     }
# }

# Verify no vulnerable versions remain on the classpath
mvn dependency:tree | grep mpxj