{"affected":[{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json"},"package":{"ecosystem":"Maven","name":"net.sf.mpxj:mpxj","purl":"pkg:maven/net.sf.mpxj/mpxj"},"ranges":[{"events":[{"introduced":"5.5.5"},{"fixed":"16.4.1"}],"type":"ECOSYSTEM"}],"versions":["10.0.0","10.0.1","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.0","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","14.0.0","14.1.0","14.2.0","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.4.0","14.5.0","14.5.1","14.5.2","15.0.0","15.1.0","15.2.0","15.3.0","15.3.1","16.0.0","16.1.0","16.2.0","16.3.0","16.4.0","5.10.0","5.11.0","5.12.0","5.13.0","5.14.0","5.5.5","5.5.6","5.5.7","5.5.8","5.5.9","5.6.0","5.6.1","5.6.2","5.6.3","5.6.4","5.6.5","5.7.0","5.7.1","5.8.0","5.9.0","6.0.0","6.1.0","6.1.2","6.2.0","7.0.0","7.0.1","7.0.2","7.0.3","7.1.0","7.2.0","7.2.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.7.0","7.7.1","7.8.0","7.8.1","7.8.2","7.8.3","7.8.4","7.9.0","7.9.1","7.9.2","7.9.3","7.9.4","7.9.5","7.9.7","7.9.8","8.0.0","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.4.0","8.5.0","8.5.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json"},"package":{"ecosystem":"RubyGems","name":"mpxj","purl":"pkg:gem/mpxj"},"ranges":[{"events":[{"introduced":"5.5.5"},{"fixed":"16.4.1"}],"type":"ECOSYSTEM"}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.0","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","14.0.0","14.1.0","14.2.0","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.4.0","14.5.0","14.5.1","14.5.2","15.0.0","15.1.0","15.2.0","15.3.0","15.3.1","16.0.0","16.1.0","16.2.0","16.3.0","16.4.0","5.10.0","5.11.0","5.12.0","5.13.0","5.14.0","5.5.5","5.5.6","5.5.7","5.5.8","5.5.9","5.6.0","5.6.1","5.6.2","5.6.3","5.6.4","5.6.5","5.7.0","5.7.1","5.8.0","5.9.0","6.0.0","6.1.0","6.1.1","6.1.2","6.2.0","6.2.1","7.0.0","7.0.1","7.0.2","7.0.3","7.1.0","7.2.0","7.2.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.7.0","7.7.1","7.8.0","7.8.1","7.8.2","7.8.3","7.8.4","7.9.0","7.9.1","7.9.2","7.9.3","7.9.4","7.9.5","7.9.6","7.9.7","7.9.8","8.0.0","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.4.0","8.5.0","8.5.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json"},"package":{"ecosystem":"NuGet","name":"MPXJ.Net","purl":"pkg:nuget/MPXJ.Net"},"ranges":[{"events":[{"introduced":"5.5.5"},{"fixed":"16.4.1"}],"type":"ECOSYSTEM"}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.2.2","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.8.0","13.9.0","14.0.0","14.1.0","14.2.0","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.4.0","14.5.0","14.5.1","14.5.2","15.0.0","15.1.0","15.2.0","15.3.0","15.3.1","16.0.0","16.1.0","16.2.0","16.3.0","16.4.0"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json"},"package":{"ecosystem":"NuGet","name":"net.sf.mpxj","purl":"pkg:nuget/net.sf.mpxj"},"ranges":[{"events":[{"introduced":"5.5.5"},{"fixed":"16.4.1"}],"type":"ECOSYSTEM"}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.0","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","5.10.0","5.11.0","5.12.0","5.13.0","5.14.0","5.5.5","5.5.6","5.5.7","5.5.8","5.5.9","5.6.0","5.6.1","5.6.2","5.6.3","5.6.4","5.6.5","5.7.0","5.7.1","5.8.0","5.9.0","6.0.0","6.1.0","6.1.2","6.2.0","6.2.1","7.0.0","7.0.1","7.0.2","7.0.3","7.1.0","7.2.0","7.2.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.7.0","7.7.1","7.8.0","7.8.1","7.8.2","7.8.3","7.8.4","7.9.0","7.9.1","7.9.2","7.9.3","7.9.4","7.9.5","7.9.7","7.9.8","8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.8","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.4.0","8.5.0","8.5.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json"},"package":{"ecosystem":"NuGet","name":"net.sf.mpxj-for-csharp","purl":"pkg:nuget/net.sf.mpxj-for-csharp"},"ranges":[{"events":[{"introduced":"5.5.5"},{"fixed":"16.4.1"}],"type":"ECOSYSTEM"}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.0","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","5.10.0","5.11.0","5.12.0","5.13.0","5.14.0","5.5.5","5.5.6","5.5.7","5.5.8","5.5.9","5.6.0","5.6.1","5.6.2","5.6.3","5.6.4","5.6.5","5.7.0","5.7.1","5.8.0","5.9.0","6.0.0","6.1.0","6.1.2","6.2.0","6.2.1","7.0.0","7.0.1","7.0.2","7.0.3","7.1.0","7.2.0","7.2.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.7.0","7.7.1","7.8.0","7.8.1","7.8.2","7.8.3","7.8.4","7.9.0","7.9.1","7.9.2","7.9.3","7.9.4","7.9.5","7.9.7","7.9.8","8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.8","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.4.0","8.5.0","8.5.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json"},"package":{"ecosystem":"NuGet","name":"net.sf.mpxj-for-vb","purl":"pkg:nuget/net.sf.mpxj-for-vb"},"ranges":[{"events":[{"introduced":"5.5.5"},{"fixed":"16.4.1"}],"type":"ECOSYSTEM"}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.0","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","5.10.0","5.11.0","5.12.0","5.13.0","5.14.0","5.5.5","5.5.6","5.5.7","5.5.8","5.5.9","5.6.0","5.6.1","5.6.2","5.6.3","5.6.4","5.6.5","5.7.0","5.7.1","5.8.0","5.9.0","6.0.0","6.1.0","6.1.2","6.2.0","6.2.1","7.0.0","7.0.1","7.0.2","7.0.3","7.1.0","7.2.0","7.2.1","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.7.0","7.7.1","7.8.0","7.8.1","7.8.2","7.8.3","7.8.4","7.9.0","7.9.1","7.9.2","7.9.3","7.9.4","7.9.5","7.9.7","7.9.8","8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.8","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.2.0","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.4.0","8.5.0","8.5.1","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json"},"package":{"ecosystem":"PyPI","name":"mpxj","purl":"pkg:pypi/mpxj"},"ranges":[{"events":[{"introduced":"5.5.5"},{"fixed":"16.4.1"}],"type":"ECOSYSTEM"}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.10.0","10.11.0","10.12.0","10.13.0","10.14.0","10.14.1","10.15.0","10.16.0","10.16.1","10.16.2","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.6.1","10.6.2","10.7.0","10.8.0","10.9.0","10.9.1","11.0.0","11.1.0","11.2.0","11.3.0","11.3.1","11.3.2","11.4.0","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","12.0.0","12.0.1","12.0.2","12.1.1","12.1.2","12.1.3","12.10.0","12.10.1","12.10.2","12.10.3","12.2.0","12.3.0","12.4.0","12.5.0","12.6.0","12.7.0","12.8.0","12.8.1","12.9.0","12.9.1","12.9.2","12.9.3","13.0.0","13.0.1","13.0.2","13.1.0","13.10.0","13.11.0","13.12.0","13.2.0","13.2.1","13.3.0","13.3.1","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.6.0","13.7.0","13.8.0","13.9.0","14.0.0","14.1.0","14.2.0","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.4.0","14.5.0","14.5.1","14.5.2","15.0.0","15.1.0","15.2.0","15.3.0","15.3.1","16.0.0","16.1.0","16.2.0","16.3.0","16.4.0","9.0.0","9.1.0","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.4.0","9.5.0","9.5.1","9.5.2","9.6.0","9.7.0","9.8.0","9.8.1","9.8.2","9.8.3"]}],"aliases":["CVE-2026-61570"],"database_specific":{"cwe_ids":["CWE-611"],"github_reviewed":true,"github_reviewed_at":"2026-09-22T20:34:25Z","nvd_published_at":null,"severity":"HIGH"},"details":"### Impact\nMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration.\n\n### Patches\nThe patch is included in MPXJ 16.4.1\n\n### Workarounds\nPotential workarounds include:\n* Avoid reading Merlin project files with MPXJ\n* Only accept Merlin project files from trusted sources\n* Preprocess Merlin SQLite databases to strip doctype declarations from the ZTIMEINTERVALS column","id":"GHSA-5vvx-3h34-f3gj","modified":"2026-09-22T21:00:08.904047269Z","published":"2026-09-22T20:34:25Z","references":[{"type":"WEB","url":"https://github.com/joniles/mpxj/security/advisories/GHSA-5vvx-3h34-f3gj"},{"type":"WEB","url":"https://github.com/joniles/mpxj/commit/6e8288bc4d1cd62842af298004dc74fe66fb0805"},{"type":"PACKAGE","url":"https://github.com/joniles/mpxj"},{"type":"WEB","url":"https://github.com/joniles/mpxj/releases/tag/v16.4.1"}],"schema_version":"1.9.0","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"}],"summary":"MPXJ: XXE Vulnerability in MerlinReader"}