EUVD-2026-84820
GHSA-5vvx-3h34-f3gj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
XXE reachable via attacker-supplied file with no auth (PR:N), but vendor confirms exfiltration is unlikely, so confidentiality is Low, not High; no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ's subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1.
Articles & Coverage 1
AnalysisAI
MPXJ's MerlinReader (versions 5.5.5 through 16.4.1) creates a default-configured DocumentBuilder when parsing XML taken from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled, so a crafted database can coerce the parser into reading arbitrary local files when an application imports an untrusted Merlin file. The practical impact is bounded: per the vendor, MPXJ's downstream handling of the parsed XML means the file contents are unlikely to be exfiltrated, so this is effectively blind XXE (local file access, possible SSRF or parser DoS) rather than reliable data disclosure, which is why the independent assessment rates Confidentiality as Low despite the 7.5 HIGH base score, and the CVSS vector shows network reachability with PR:N/UI:N (unauthenticated, no user interaction beyond the file being processed by the host application). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an application or service that uses MPXJ's MerlinReader to parse an attacker-controlled Merlin project SQLite database (versions 5.5.5 through 16.4.1); the malicious XML must reside in the ZTIMEINTERVALS column, which is parsed by a DocumentBuilder created with default settings (doctype declarations and external entities enabled). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a lower-priority issue than its 7.5 (HIGH) CVSS score suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to MPXJ 16.4.1 or later across every affected ecosystem - Maven net.sf.mpxj:mpxj, RubyGems mpxj, and NuGet MPXJ.Net / net.sf.mpxj - which applies the upstream fix (commit 6e8288bc4d1cd62842af298004dc74fe66fb0805) that forces disallow-doctype-decl on the DocumentBuilder used by MerlinReader (see https://github.com/joniles/mpxj/security/advisories/GHSA-5vvx-3h34-f3gj and https://github.com/joniles/mpxj/releases/tag/v16.4.1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application, service, or scheduled job that embeds MPXJ at versions 5.5.5 through 16.4.1 and determine which of them accept Merlin SQLite files from external parties; where they do, temporarily suspend untrusted Merlin imports or route them through a hardened, sandboxed conversion service, and configure the underlying JVM/XML parser to disallow doctype declarations and external entities (enable XMLConstants.FEATURE_SECURE_PROCESSING, set disallow-doctype-decl to true, and disable external-general-entities and external-parameter-entities) wherever MerlinReader is invoked. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Share
External POC / Exploit Code
Leaving vuln.today