MEDIUM5.3
GHSA-7952-gx68-cjqr
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
Quick fix
GHSA-7952-gx68-cjqr — MPXJ.Net: upgrade to the fixed version with the command below.
dotnet add package MPXJ.Net --version 16.5.0Details
### Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system.
### Patches This issue is addressed in MPXJ version 16.5.0.
### Workarounds Do not read PRX or STX files from untrusted sources.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/net.sf.mpxj
Introduced in:
7.3.0Fixed in: 16.5.0Fix
dotnet add package net.sf.mpxj --version 16.5.0NuGet/net.sf.mpxj-for-csharp
Introduced in:
7.3.0Fixed in: 16.5.0Fix
dotnet add package net.sf.mpxj-for-csharp --version 16.5.0NuGet/net.sf.mpxj-for-vb
Introduced in:
7.3.0Fixed in: 16.5.0Fix
dotnet add package net.sf.mpxj-for-vb --version 16.5.0Maven/net.sf.mpxj:mpxj
Introduced in:
7.3.0Fixed in: 16.5.0Fix
# pom.xml: bump <version>16.5.0</version> for net.sf.mpxj:mpxj