CVE-2026-61570: MPXJ XXE Vulnerability in MerlinReader Allows Arbitrary File Read
Summary
CVE-2026-61570: MPXJ: XXE Vulnerability in MerlinReader. Affects net.sf.mpxj:mpxj versions >= 5.5.5, < 16.4.1. Fixed in 16.4.1. How to fix ↓
Also tracked for
- mpxj · PyPI
The same CVE-2026-61570 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MPXJ is an open-source library designed for reading and writing project management files in various formats, including Microsoft Project and others. It provides developers with the ability to manipulate project data programmatically. However, a vulnerability has been identified in the way MPXJ handles XML content, particularly in the parsing of the ZTIMEINTERVALS column from Merlin project SQLite files, which can lead to security risks.
Vulnerability Detail
The vulnerability arises from MPXJ using the default configuration for creating a DocumentBuilder instance, which enables doctype declarations when parsing XML content. This configuration flaw allows an attacker to craft a malicious XML payload that can read arbitrary files from the server. Although the data can be read, the way MPXJ processes the parsed XML means that the extracted data is unlikely to be exfiltrated. This vulnerability is classified under CWE-611, which pertains to XML External Entity (XXE) processing.
How To Fix
Minimum fixed version
16.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider the following workarounds:
- Avoid reading Merlin project files with MPXJ.
- Only accept Merlin project files from trusted sources.
- Preprocess Merlin SQLite databases to strip doctype declarations from the ZTIMEINTERVALS column.
Conclusion
The MPXJ library has a significant vulnerability (CVE-2026-61570) that allows for arbitrary file reading due to improper XML parsing. It is crucial to update to version 16.4.1 or later to mitigate this risk. If immediate updates are not feasible, applying the recommended workarounds can help reduce exposure.
See every vulnerability recorded for net.sf.mpxj:mpxj →
FAQ
CVE-2026-61570 is a vulnerability in the MPXJ library that allows for arbitrary file reading due to improper XML parsing.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If you cannot update the package, implement the suggested workarounds to mitigate the risk until you can apply the patch.
More information about MPXJ can be found on its official documentation and GitHub repository, which provide insights into its functionalities and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.sf.mpxj:mpxj.
