MPXJ CVE-2026-65829

Exploitation requires that an application using MPXJ (Java, or the MPXJ.Net/rubygems/pip ports) at version >= 7.3.0 and < 16.5.0 reads an attacker-controlled Primavera P3 PRX file or SureTrak STX file - both of which are zip-based archives whose entries MPXJ extracts to disk without canonical-path validation. The limiting factor is delivery: the attacker must get their crafted PRX/STX file into a code path that calls the P3 or SureTrak reader (e.g. an upload/import feature that accepts these formats). It does not depend on authentication or a non-default configuration setting, but it is entirely inert unless untrusted PRX/STX input is parsed; the documented workaround is to not read PRX/STX files from untrusted sources.

This is a moderate-severity, low-urgency issue whose real-world risk is heavily gated by exploitation preconditions. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3) advertises a network, unauthenticated, low-complexity path with limited integrity-only impact, but the mechanism - MPXJ extracting a zip-based Primavera P3 PRX or SureTrak STX archive without validating entry paths (classic zip-slip / CWE-22) - only fires when the host application actually reads an attacker-supplied PRX/STX file. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so the correct exploitation status is 'no public exploit identified at time of analysis'; this is a real-but-latent library flaw rather than an actively exploited priority. Two signals are in tension and worth flagging for verification: (1) AV:N is only defensible if a service auto-ingests uploaded project files - for a desktop/CLI consumer of the library this is effectively local (AV:L), so 'network vector' should be verified against the actual deployment. (2) The impact rating is arguably understated: 'write files to arbitrary locations in the filesystem' is a powerful integrity primitive (overwriting configs, cron, startup scripts) that can escalate beyond I:L toward code execution, yet the vendor scored only I:L and A:N - treat the 5.3 as a conservative floor, not a ceiling.

An application (or service) that uses MPXJ to import Primavera P3 or SureTrak project plans is fed a maliciously crafted PRX or STX archive containing an entry with a traversal path (e.g. '../../etc/...' or an absolute path). When MPXJ extracts the archive, it writes the entry outside the intended temp directory, letting the attacker plant or overwrite files at attacker-chosen locations, which can corrupt data or seed executable/config files for follow-on code execution. No public exploit code is identified, but the underlying zip-slip pattern is well-documented and trivially reproducible given a sample file.