{ "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-7952-gx68-cjqr/GHSA-7952-gx68-cjqr.json" }, "package": { "ecosystem": "NuGet", "name": "MPXJ.Net", "purl": "pkg:nuget/MPXJ.Net" }, "ranges": [ { "events": [ { "introduced": "7.3.0" }, { "fixed": "16.5.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.2.2", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.8.0", "13.9.0", "14.0.0", "14.1.0", "14.2.0", "14.3.0", "14.3.1", "14.3.2", "14.3.3", "14.3.4", "14.3.5", "14.4.0", "14.5.0", "14.5.1", "14.5.2", "15.0.0", "15.1.0", "15.2.0", "15.3.0", "15.3.1", "16.0.0", "16.1.0", "16.2.0", "16.3.0", "16.4.0", "16.4.1" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-7952-gx68-cjqr/GHSA-7952-gx68-cjqr.json" }, "package": { "ecosystem": "RubyGems", "name": "mpxj", "purl": "pkg:gem/mpxj" }, "ranges": [ { "events": [ { "introduced": "7.3.0" }, { "fixed": "16.5.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.2", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.0", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "14.0.0", "14.1.0", "14.2.0", "14.3.0", "14.3.1", "14.3.2", "14.3.3", "14.3.4", "14.3.5", "14.4.0", "14.5.0", "14.5.1", "14.5.2", "15.0.0", "15.1.0", "15.2.0", "15.3.0", "15.3.1", "16.0.0", "16.1.0", "16.2.0", "16.3.0", "16.4.0", "16.4.1", "7.3.0", "7.4.0", "7.4.1", "7.4.2", "7.4.3", "7.4.4", "7.5.0", "7.6.0", "7.6.1", "7.6.2", "7.6.3", "7.7.0", "7.7.1", "7.8.0", "7.8.1", "7.8.2", "7.8.3", "7.8.4", "7.9.0", "7.9.1", "7.9.2", "7.9.3", "7.9.4", "7.9.5", "7.9.6", "7.9.7", "7.9.8", "8.0.0", "8.0.2", "8.0.3", "8.0.4", "8.0.5", "8.0.6", "8.0.7", "8.0.8", "8.1.0", "8.1.1", "8.1.2", "8.1.3", "8.1.4", "8.2.0", "8.3.0", "8.3.1", "8.3.2", "8.3.3", "8.3.4", "8.3.5", "8.4.0", "8.5.0", "8.5.1", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-7952-gx68-cjqr/GHSA-7952-gx68-cjqr.json" }, "package": { "ecosystem": "PyPI", "name": "mpxj", "purl": "pkg:pypi/mpxj" }, "ranges": [ { "events": [ { "introduced": "7.3.0" }, { "fixed": "16.5.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.2", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "14.0.0", "14.1.0", "14.2.0", "14.3.0", "14.3.1", "14.3.2", "14.3.3", "14.3.4", "14.3.5", "14.4.0", "14.5.0", "14.5.1", "14.5.2", "15.0.0", "15.1.0", "15.2.0", "15.3.0", "15.3.1", "16.0.0", "16.1.0", "16.2.0", "16.3.0", "16.4.0", "16.4.1", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-7952-gx68-cjqr/GHSA-7952-gx68-cjqr.json" }, "package": { "ecosystem": "NuGet", "name": "net.sf.mpxj", "purl": "pkg:nuget/net.sf.mpxj" }, "ranges": [ { "events": [ { "introduced": "7.3.0" }, { "fixed": "16.5.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.2", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.0", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "7.3.0", "7.4.0", "7.4.1", "7.4.2", "7.4.3", "7.4.4", "7.5.0", "7.6.0", "7.6.1", "7.6.2", "7.6.3", "7.7.0", "7.7.1", "7.8.0", "7.8.1", "7.8.2", "7.8.3", "7.8.4", "7.9.0", "7.9.1", "7.9.2", "7.9.3", "7.9.4", "7.9.5", "7.9.7", "7.9.8", "8.0.0", "8.0.1", "8.0.2", "8.0.3", "8.0.4", "8.0.5", "8.0.6", "8.0.8", "8.1.0", "8.1.1", "8.1.2", "8.1.3", "8.1.4", "8.2.0", "8.3.0", "8.3.1", "8.3.2", "8.3.3", "8.3.4", "8.3.5", "8.4.0", "8.5.0", "8.5.1", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-7952-gx68-cjqr/GHSA-7952-gx68-cjqr.json" }, "package": { "ecosystem": "NuGet", "name": "net.sf.mpxj-for-csharp", "purl": "pkg:nuget/net.sf.mpxj-for-csharp" }, "ranges": [ { "events": [ { "introduced": "7.3.0" }, { "fixed": "16.5.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.2", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.0", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "7.3.0", "7.4.0", "7.4.1", "7.4.2", "7.4.3", "7.4.4", "7.5.0", "7.6.0", "7.6.1", "7.6.2", "7.6.3", "7.7.0", "7.7.1", "7.8.0", "7.8.1", "7.8.2", "7.8.3", "7.8.4", "7.9.0", "7.9.1", "7.9.2", "7.9.3", "7.9.4", "7.9.5", "7.9.7", "7.9.8", "8.0.0", "8.0.1", "8.0.2", "8.0.3", "8.0.4", "8.0.5", "8.0.6", "8.0.8", "8.1.0", "8.1.1", "8.1.2", "8.1.3", "8.1.4", "8.2.0", "8.3.0", "8.3.1", "8.3.2", "8.3.3", "8.3.4", "8.3.5", "8.4.0", "8.5.0", "8.5.1", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-7952-gx68-cjqr/GHSA-7952-gx68-cjqr.json" }, "package": { "ecosystem": "NuGet", "name": "net.sf.mpxj-for-vb", "purl": "pkg:nuget/net.sf.mpxj-for-vb" }, "ranges": [ { "events": [ { "introduced": "7.3.0" }, { "fixed": "16.5.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.2", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.0", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "7.3.0", "7.4.0", "7.4.1", "7.4.2", "7.4.3", "7.4.4", "7.5.0", "7.6.0", "7.6.1", "7.6.2", "7.6.3", "7.7.0", "7.7.1", "7.8.0", "7.8.1", "7.8.2", "7.8.3", "7.8.4", "7.9.0", "7.9.1", "7.9.2", "7.9.3", "7.9.4", "7.9.5", "7.9.7", "7.9.8", "8.0.0", "8.0.1", "8.0.2", "8.0.3", "8.0.4", "8.0.5", "8.0.6", "8.0.8", "8.1.0", "8.1.1", "8.1.2", "8.1.3", "8.1.4", "8.2.0", "8.3.0", "8.3.1", "8.3.2", "8.3.3", "8.3.4", "8.3.5", "8.4.0", "8.5.0", "8.5.1", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-7952-gx68-cjqr/GHSA-7952-gx68-cjqr.json" }, "package": { "ecosystem": "Maven", "name": "net.sf.mpxj:mpxj", "purl": "pkg:maven/net.sf.mpxj/mpxj" }, "ranges": [ { "events": [ { "introduced": "7.3.0" }, { "fixed": "16.5.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.0", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "14.0.0", "14.1.0", "14.2.0", "14.3.0", "14.3.1", "14.3.2", "14.3.3", "14.3.4", "14.3.5", "14.4.0", "14.5.0", "14.5.1", "14.5.2", "15.0.0", "15.1.0", "15.2.0", "15.3.0", "15.3.1", "16.0.0", "16.1.0", "16.2.0", "16.3.0", "16.4.0", "16.4.1", "7.3.0", "7.4.0", "7.4.1", "7.4.2", "7.4.3", "7.4.4", "7.5.0", "7.6.0", "7.6.1", "7.6.2", "7.6.3", "7.7.0", "7.7.1", "7.8.0", "7.8.1", "7.8.2", "7.8.3", "7.8.4", "7.9.0", "7.9.1", "7.9.2", "7.9.3", "7.9.4", "7.9.5", "7.9.7", "7.9.8", "8.0.0", "8.0.2", "8.0.3", "8.0.4", "8.0.5", "8.0.6", "8.0.7", "8.0.8", "8.1.0", "8.1.1", "8.1.2", "8.1.3", "8.1.4", "8.2.0", "8.3.0", "8.3.1", "8.3.2", "8.3.3", "8.3.4", "8.3.5", "8.4.0", "8.5.0", "8.5.1", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] } ], "aliases": [ "CVE-2026-65829" ], "database_specific": { "cwe_ids": [ "CWE-22" ], "github_reviewed": true, "github_reviewed_at": "2026-09-22T20:34:27Z", "nvd_published_at": null, "severity": "MODERATE" }, "details": "### Impact\nWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system.\n\n### Patches\nThis issue is addressed in MPXJ version 16.5.0.\n\n### Workarounds\nDo not read PRX or STX files from untrusted sources.", "id": "GHSA-7952-gx68-cjqr", "modified": "2026-09-22T21:00:08.998689184Z", "published": "2026-09-22T20:34:27Z", "references": [ { "type": "WEB", "url": "https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr" }, { "type": "WEB", "url": "https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f" }, { "type": "PACKAGE", "url": "https://github.com/joniles/mpxj" }, { "type": "WEB", "url": "https://github.com/joniles/mpxj/releases/tag/v16.5.0" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "type": "CVSS_V3" } ], "summary": "MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers" }