MEDIUM5.3
PYSEC-2026-4108
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
Quick fix
PYSEC-2026-4108 — mpxj: upgrade to the fixed version with the command below.
pip install --upgrade 'mpxj>=16.5.0'Details
### Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system.
### Patches This issue is addressed in MPXJ version 16.5.0.
### Workarounds Do not read PRX or STX files from untrusted sources.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr[WEB]
- https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f[WEB]
- https://github.com/joniles/mpxj[PACKAGE]
- https://github.com/joniles/mpxj/releases/tag/v16.5.0[WEB]
- https://pypi.org/project/mpxj[PACKAGE]
- https://github.com/advisories/GHSA-7952-gx68-cjqr[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-65829[ADVISORY]