CVE-2026-65829: 
Java vulnerability analysis and mitigation

CVE-2026-65829 is a path traversal vulnerability in MPXJ, an open source library for reading and writing project plan files across multiple formats and languages. When parsing a specially crafted Primavera P3 PRX or SureTrak STX file, MPXJ can be induced to write files to arbitrary locations on the filesystem. The vulnerability affects MPXJ versions 7.3.0 through 16.4.x across all supported package ecosystems (Maven, NuGet, pip, RubyGems) and was disclosed on July 3, 2026, with a fix released in version 16.5.0. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). Both P3PRXFileReader.java and SureTrakSTXFileReader.java extract embedded file entries from archive-like PRX/STX formats by constructing a File object from a caller-controlled filename string embedded in the file, without first validating that the resolved path remains within the intended extraction directory. An attacker can embed path traversal sequences (e.g., ../../) in the filename field of a crafted PRX or STX file, causing MPXJ to write arbitrary content to locations outside the target directory when the file is parsed. The fix adds a FileHelper.validateTargetFileIsInParentDirectory() call in both readers that uses canonical path comparison to reject any entry whose resolved path escapes the parent directory (GitHub Commit, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to write files to arbitrary filesystem locations accessible by the process running MPXJ. This could enable overwriting of configuration files, planting of malicious scripts, or corruption of application data, leading to integrity compromise. Confidentiality and availability are not directly impacted according to the CVSS scoring, but file write primitives can serve as a stepping stone for privilege escalation or persistent access in certain deployment contexts (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating very low probability of near-term exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that a target application passes attacker-controlled PRX or STX files to MPXJ for parsing, which limits the practical attack surface to scenarios where untrusted project files are processed (GitHub Advisory, Feedly).

1. Craft a malicious PRX or STX file: Create a Primavera P3 PRX or SureTrak STX file containing an embedded file entry whose filename field includes path traversal sequences (e.g., ../../etc/cron.d/malicious or ../../webroot/shell.jsp).
2. Deliver the file to the target: Submit the crafted file to any application or service that uses a vulnerable version of MPXJ (7.3.0–16.4.x) to parse PRX or STX project files — for example, via a file upload endpoint or shared network location.
3. Trigger parsing: Cause the application to invoke MPXJ's P3PRXFileReader or SureTrakSTXFileReader on the malicious file. MPXJ will extract the embedded entry and write it to the attacker-specified path without validating that the destination is within the intended extraction directory.
4. Achieve objective: The written file lands at the traversal-specified location on the server filesystem, potentially overwriting sensitive files, planting a web shell, or injecting malicious configuration — depending on the process's write permissions (GitHub Commit, GitHub Advisory).

• File System: Unexpected files appearing in directories outside the normal MPXJ extraction/temp directory, particularly in sensitive locations such as web roots, cron directories, or application configuration paths; files with timestamps correlating to PRX/STX parsing events.
• Logs: Application logs showing MPXJ parsing of PRX or STX files received from external or untrusted sources; IOException messages containing "Entry is outside of the target dir" in patched versions (indicating attempted exploitation).
• Process: File write operations by the Java process (or .NET/Python/Ruby runtime) to unexpected filesystem paths during or immediately after project file parsing.

Upgrade MPXJ to version 16.5.0 or later across all affected package ecosystems: Maven (net.sf.mpxj:mpxj), NuGet (MPXJ.Net, net.sf.mpxj, net.sf.mpxj-for-csharp, net.sf.mpxj-for-vb), pip (mpxj), and RubyGems (mpxj). As a workaround for environments that cannot immediately upgrade, avoid parsing PRX or STX files from untrusted or unverified sources. No other configuration-based mitigations have been identified (GitHub Advisory, MPXJ Release).

The vulnerability was reported by security researcher czTangt and acknowledged by the MPXJ maintainer (joniles) in the official GitHub Security Advisory. No significant broader media coverage or notable community commentary beyond the advisory and standard vulnerability database entries has been observed (GitHub Advisory).