| Package | Affected versions | Patched versions |
|---|---|---|
| net.sf.mpxj:mpxj | ≥ 7.3.0, < 16.5.0 | 16.5.0 |
| MPXJ.Net | ≥ 7.3.0, < 16.5.0 | 16.5.0 |
| net.sf.mpxj | ≥ 7.3.0, < 16.5.0 | 16.5.0 |
| net.sf.mpxj-for-csharp | ≥ 7.3.0, < 16.5.0 | 16.5.0 |
| net.sf.mpxj-for-vb | ≥ 7.3.0, < 16.5.0 | 16.5.0 |
| mpxj | ≥ 7.3.0, < 16.5.0 | 16.5.0 |
| mpxj | ≥ 7.3.0, < 16.5.0 | 16.5.0 |
When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system.
This issue is addressed in MPXJ version 16.5.0.
Do not read PRX or STX files from untrusted sources.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free