Résumé
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
Détails de l’avis
Impact
When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system.
Patches
This issue is addressed in MPXJ version 16.5.0.
Workarounds
Do not read PRX or STX files from untrusted sources.
Références
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-104102
copyparty FTP: upload outside defined volumes (limited path traversal)
- MEDIUMCVE-2026-84320
Nginx UI: Auto backup name allows path traversal outside validated storage path
- MEDIUMCVE-2026-108258
Shiny for Python has path traversal in bookmark restore
- MEDIUMCVE-2026-107844
Contao: Path traversal in the images controller
- HIGHGHSA-fr26-jjhm-638c
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
- MEDIUMCVE-2026-107716
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry