---
id: CVE-2026-61570
title: >-
  MPXJ is an open source library to read and write project plans from a variety
  of file formats and databases
summary: >-
  MPXJ is an open source library to read and write project plans from a variety
  of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a
  DocumentBuilder with default settings while parsing XML from the
  ZTIMEINTERVALS …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-611
vendor: sf
product: 'net.sf.mpxj:mpxj'
affected:
  - 'net.sf.mpxj:mpxj >= 5.5.5, < 16.4.1'
  - 'mpxj >= 5.5.5, < 16.4.1'
  - 'MPXJ.Net >= 5.5.5, < 16.4.1'
  - 'net.sf.mpxj >= 5.5.5, < 16.4.1'
  - 'net.sf.mpxj-for-csharp >= 5.5.5, < 16.4.1'
  - 'net.sf.mpxj-for-vb >= 5.5.5, < 16.4.1'
  - 'mpxj >= 5.5.5, < 16.4.1'
patched:
  - 'net.sf.mpxj:mpxj 16.4.1'
  - mpxj 16.4.1
  - MPXJ.Net 16.4.1
  - net.sf.mpxj 16.4.1
  - net.sf.mpxj-for-csharp 16.4.1
  - net.sf.mpxj-for-vb 16.4.1
  - mpxj 16.4.1
published: '2026-09-22'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T16:17:08.590'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61570'
references:
  - url: >-
      https://github.com/joniles/mpxj/commit/6e8288bc4d1cd62842af298004dc74fe66fb0805
    label: security-advisories@github.com
  - url: 'https://github.com/joniles/mpxj/releases/tag/v16.4.1'
    label: security-advisories@github.com
  - url: 'https://github.com/joniles/mpxj/security/advisories/GHSA-5vvx-3h34-f3gj'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-5vvx-3h34-f3gj'
  - url: 'https://github.com/joniles/mpxj'
tags:
  - nvd
  - ghsa
  - maven
  - cve.org
  - osv
epss: 0.00474
epssPercentile: 0.40179
aliases:
  - GHSA-5vvx-3h34-f3gj
ecosystem: maven
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-24T15:19:11.763969Z'
ingestedAt: '2026-09-22T20:10:15.094Z'
---

## Overview

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ's subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61570)

Affected packages:

- `net.sf.mpxj:mpxj >= 5.5.5, < 16.4.1`
- `mpxj >= 5.5.5, < 16.4.1`
- `MPXJ.Net >= 5.5.5, < 16.4.1`
- `net.sf.mpxj >= 5.5.5, < 16.4.1`
- `net.sf.mpxj-for-csharp >= 5.5.5, < 16.4.1`
- `net.sf.mpxj-for-vb >= 5.5.5, < 16.4.1`
- `mpxj >= 5.5.5, < 16.4.1`

Patched in:

- `net.sf.mpxj:mpxj 16.4.1`
- `mpxj 16.4.1`
- `MPXJ.Net 16.4.1`
- `net.sf.mpxj 16.4.1`
- `net.sf.mpxj-for-csharp 16.4.1`
- `net.sf.mpxj-for-vb 16.4.1`
- `mpxj 16.4.1`

Source: https://github.com/advisories/GHSA-5vvx-3h34-f3gj