CVE-2026-61570: 
Java vulnerability analysis and mitigation

CVE-2026-61570 is an XML External Entity (XXE) injection vulnerability in the MerlinReader component of MPXJ, an open-source Java library for reading and writing project plan files. Affecting versions 5.5.5 through 16.4.0, the flaw allows a crafted Merlin project SQLite database to trigger arbitrary local file reads during XML parsing. The vulnerability was disclosed on September 22, 2026, with a fix released in version 16.4.1. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-611 (Improper Restriction of XML External Entity Reference). In MerlinReader.java, a DocumentBuilder instance was created using DocumentBuilderFactory.newInstance().newDocumentBuilder() — the default configuration — which leaves doctype declarations and external entity resolution enabled. When MPXJ parses the XML content stored in the ZTIMEINTERVALS column of a Merlin project SQLite database, a malicious XML payload with an external entity reference (e.g., file:///etc/passwd) can cause the parser to read arbitrary local files. The fix, applied in commit 6e8288b, introduces a shared UnmarshalHelper.createDocumentBuilder() method that explicitly sets the http://apache.org/xml/features/disallow-doctype-decl feature to true on the DocumentBuilderFactory before creating the builder (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to cause the XML parser to read arbitrary files from the local filesystem of the host running the MPXJ library. However, the advisory notes that due to how MPXJ subsequently processes the parsed XML, actual exfiltration of the file contents is unlikely in practice. There is no integrity or availability impact; the primary risk is a partial confidentiality breach limited to the local file system of the affected application server (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-61570. The EPSS score is 0.0, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to supply a crafted Merlin project SQLite database file to an application using a vulnerable version of MPXJ, which limits the attack surface to scenarios where untrusted project files are processed (GitHub Advisory).

1. Craft a malicious SQLite database: Create or modify a Merlin project .sqlite file, inserting a malicious XML payload into the ZTIMEINTERVALS column. The payload should include a DOCTYPE declaration with an external entity referencing a target local file, e.g.:

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>

2. Deliver the file: Provide the crafted SQLite database to a target application that uses a vulnerable version of MPXJ (>= 5.5.5, < 16.4.1) to parse Merlin project files — for example, via a file upload feature or shared network path.
3. Trigger parsing: Cause the application to open and parse the malicious database using MerlinReader. MPXJ will instantiate a DocumentBuilder with default settings and parse the XML from ZTIMEINTERVALS.
4. File read occurs: The XML parser resolves the external entity and reads the referenced local file. Due to MPXJ's subsequent XML processing, direct exfiltration of the file content is unlikely, but the read operation does occur on the server (GitHub Advisory, GitHub Commit).

• File System: Unexpected or untrusted .sqlite files submitted to applications that process Merlin project files.
• Logs: Application or Java runtime logs showing XML parsing errors related to DOCTYPE declarations or external entity resolution (e.g., SAXParseException referencing file:// URIs) when processing Merlin project files.
• Process: Java process making unexpected file system reads to sensitive paths (e.g., /etc/passwd, /etc/shadow, Windows SAM files) during MPXJ MerlinReader execution.

Upgrade MPXJ to version 16.4.1 or later, which disables doctype declarations in the DocumentBuilder used by MerlinReader. The fix is available across all supported package ecosystems: Maven (net.sf.mpxj:mpxj), NuGet (MPXJ.Net, net.sf.mpxj, net.sf.mpxj-for-csharp, net.sf.mpxj-for-vb), pip (mpxj), and RubyGems (mpxj). If upgrading immediately is not possible, workarounds include: avoiding parsing of Merlin project files with MPXJ, accepting Merlin files only from trusted sources, or preprocessing SQLite databases to strip DOCTYPE declarations from the ZTIMEINTERVALS column before parsing (GitHub Advisory, MPXJ Release).

The vulnerability was credited to researcher dyingman1 and published by the MPXJ maintainer (joniles) via GitHub Security Advisories. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (GitHub Advisory).