GHSA-7952-gx68-cjqr
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| NuGet | MPXJ.Net | >= 7.3.0, < 16.5.0 | 16.5.0 |
| RubyGems | mpxj | >= 7.3.0, < 16.5.0 | 16.5.0 |
| PyPI | mpxj | >= 7.3.0, < 16.5.0 | 16.5.0 |
| NuGet | net.sf.mpxj | >= 7.3.0, < 16.5.0 | 16.5.0 |
| NuGet | net.sf.mpxj-for-csharp | >= 7.3.0, < 16.5.0 | 16.5.0 |
| NuGet | net.sf.mpxj-for-vb | >= 7.3.0, < 16.5.0 | 16.5.0 |
| Maven | net.sf.mpxj:mpxj | >= 7.3.0, < 16.5.0 | 16.5.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system.
### Patches
This issue is addressed in MPXJ version 16.5.0.
### Workarounds
Do not read PRX or STX files from untrusted sources.
References
External links from the advisory. They lead to third-party sites.