{"id":"CVE-2024-49771","aliases":["GHSA-j945-c44v-97g6","PYSEC-2026-1681"],"title":"MPXJ has a Potential Path Traversal Vulnerability","summary":"MPXJ has a Potential Path Traversal Vulnerability","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","vendor":"sf","product":"net.sf.mpxj:mpxj","ecosystem":"maven","affected":["net.sf.mpxj:mpxj >= 8.3.5, < 13.5.1","mpxj >= 8.3.5, < 13.5.1","mpxj >= 8.3.5, < 13.5.1","net.sf.mpxj >= 8.3.5, < 13.5.1","net.sf.mpxj-for-csharp >= 8.3.5, < 13.5.1","net.sf.mpxj-for-vb >= 8.3.5, < 13.5.1","MPXJ.Net >= 13.0.0, < 13.5.1"],"patched":["net.sf.mpxj:mpxj 13.5.1","mpxj 13.5.1","mpxj 13.5.1","net.sf.mpxj 13.5.1","net.sf.mpxj-for-csharp 13.5.1","net.sf.mpxj-for-vb 13.5.1","MPXJ.Net 13.5.1"],"published":"2024-10-28","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-j945-c44v-97g6","references":[{"url":"https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49771"},{"url":"https://github.com/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0"},{"url":"https://github.com/joniles/mpxj"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mpxj/CVE-2024-49771.yml"}],"tags":["osv","maven"],"epss":0.00481,"epssPercentile":0.40615,"ingestedAt":"2026-07-08T18:25:50.633Z","slug":"CVE-2024-49771","body":"## Overview\n\n### Impact\nThe patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations.\n\n### Patches\nThe issue is addressed in MPXJ version 13.5.1\n\n### Workarounds\nDo not pass zip files to MPXJ.\n\n### References\nN/A\n\n### Credits\nIssue report and patch provided by yyjLF and sprinkle\n\n## Affected packages\n\n- `net.sf.mpxj:mpxj >= 8.3.5, < 13.5.1`\n- `mpxj >= 8.3.5, < 13.5.1`\n- `mpxj >= 8.3.5, < 13.5.1`\n- `net.sf.mpxj >= 8.3.5, < 13.5.1`\n- `net.sf.mpxj-for-csharp >= 8.3.5, < 13.5.1`\n- `net.sf.mpxj-for-vb >= 8.3.5, < 13.5.1`\n- `MPXJ.Net >= 13.0.0, < 13.5.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `net.sf.mpxj:mpxj 13.5.1`\n- `mpxj 13.5.1`\n- `mpxj 13.5.1`\n- `net.sf.mpxj 13.5.1`\n- `net.sf.mpxj-for-csharp 13.5.1`\n- `net.sf.mpxj-for-vb 13.5.1`\n- `MPXJ.Net 13.5.1`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}