CVE-2024-49771 json
MPXJ has a Potential Path Traversal Vulnerability
published 2024-10-28 2 y ago modified 2026-07-07 4 mo ago also EUVD-2024-3068 , GHSA-j945-c44v-97g6 , PYSEC-2026-1681
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.
Patch / fix
- maven net.sf.mpxj:mpxj 13.5.1
- rubygems mpxj 13.5.1
- pypi mpxj 13.5.1
- nuget net.sf.mpxj 13.5.1
- nuget net.sf.mpxj-for-csharp 13.5.1
- nuget net.sf.mpxj-for-vb 13.5.1
- nuget MPXJ.Net 13.5.1
- mpxj mpxj 13.5.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | net.sf.mpxj:mpxj | >=8.3.5, <13.5.1 |
13.5.1 |
| rubygems | mpxj | >=8.3.5, <13.5.1 |
13.5.1 |
| pypi | mpxj | >=8.3.5, <13.5.1 |
13.5.1 |
| nuget | net.sf.mpxj | >=8.3.5, <13.5.1 |
13.5.1 |
| nuget | net.sf.mpxj-for-csharp | >=8.3.5, <13.5.1 |
13.5.1 |
| nuget | net.sf.mpxj-for-vb | >=8.3.5, <13.5.1 |
13.5.1 |
| nuget | MPXJ.Net | >=13.0.0, <13.5.1 |
13.5.1 |
Affected products
- joniles mpxj
- mpxj mpxj
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0
web
-
github.com
/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-49771
advisory
-
github.com
/joniles/mpxj
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/mpxj/CVE-2024-49771.yml
web
-
pypi.org
/project/mpxj
package
-
github.com
/advisories/GHSA-j945-c44v-97g6
advisory
Sources
- CVE List CVE-2024-49771
- GitHub Advisory GHSA-j945-c44v-97g6
- NVD CVE-2024-49771
- OSV PYSEC-2026-1681
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.