---
id: CVE-2024-49771
aliases:
  - GHSA-j945-c44v-97g6
  - PYSEC-2026-1681
title: MPXJ has a Potential Path Traversal Vulnerability
summary: MPXJ has a Potential Path Traversal Vulnerability
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
vendor: sf
product: 'net.sf.mpxj:mpxj'
ecosystem: maven
affected:
  - 'net.sf.mpxj:mpxj >= 8.3.5, < 13.5.1'
  - 'mpxj >= 8.3.5, < 13.5.1'
  - 'mpxj >= 8.3.5, < 13.5.1'
  - 'net.sf.mpxj >= 8.3.5, < 13.5.1'
  - 'net.sf.mpxj-for-csharp >= 8.3.5, < 13.5.1'
  - 'net.sf.mpxj-for-vb >= 8.3.5, < 13.5.1'
  - 'MPXJ.Net >= 13.0.0, < 13.5.1'
patched:
  - 'net.sf.mpxj:mpxj 13.5.1'
  - mpxj 13.5.1
  - mpxj 13.5.1
  - net.sf.mpxj 13.5.1
  - net.sf.mpxj-for-csharp 13.5.1
  - net.sf.mpxj-for-vb 13.5.1
  - MPXJ.Net 13.5.1
published: '2024-10-28'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-j945-c44v-97g6'
references:
  - url: 'https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-49771'
  - url: >-
      https://github.com/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0
  - url: 'https://github.com/joniles/mpxj'
  - url: >-
      https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mpxj/CVE-2024-49771.yml
tags:
  - osv
  - maven
epss: 0.00481
epssPercentile: 0.40628
ingestedAt: '2026-07-08T18:25:50.633Z'
---

## Overview

### Impact
The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations.

### Patches
The issue is addressed in MPXJ version 13.5.1

### Workarounds
Do not pass zip files to MPXJ.

### References
N/A

### Credits
Issue report and patch provided by yyjLF and sprinkle

## Affected packages

- `net.sf.mpxj:mpxj >= 8.3.5, < 13.5.1`
- `mpxj >= 8.3.5, < 13.5.1`
- `mpxj >= 8.3.5, < 13.5.1`
- `net.sf.mpxj >= 8.3.5, < 13.5.1`
- `net.sf.mpxj-for-csharp >= 8.3.5, < 13.5.1`
- `net.sf.mpxj-for-vb >= 8.3.5, < 13.5.1`
- `MPXJ.Net >= 13.0.0, < 13.5.1`

## Remediation

Upgrade to a patched release:

- `net.sf.mpxj:mpxj 13.5.1`
- `mpxj 13.5.1`
- `mpxj 13.5.1`
- `net.sf.mpxj 13.5.1`
- `net.sf.mpxj-for-csharp 13.5.1`
- `net.sf.mpxj-for-vb 13.5.1`
- `MPXJ.Net 13.5.1`