CVE-2026-61570
Received Received - Intake

XML External Entity Processing in MPXJ Library

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ's subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-23
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-61570
EUVD
EUVD-2026-84820

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mpxj mpxj to 16.4.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an XML External Entity (XXE) vulnerability in the MPXJ library's MerlinReader component. It affects versions 5.5.5 to 16.4.0. The issue occurs when parsing XML from a Merlin project SQLite database's ZTIMEINTERVALS column. The library enables doctype declarations and external entities by default, allowing a crafted database to read arbitrary local files. The vulnerability is fixed in version 16.4.1.

Detection Guidance

To detect this vulnerability, check if your system uses MPXJ versions between 5.5.5 and 16.4.0. Inspect project files or databases processed by MerlinReader for XML doctype declarations in the ZTIMEINTERVALS column. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to read files on your system that the vulnerable application can access. However, the impact is limited because MPXJ's processing of the parsed XML makes it unlikely for the attacker to access the file contents. The attack requires no privileges or user interaction and can be executed remotely.

Compliance Impact

This vulnerability could potentially lead to unauthorized data access, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Unauthorized file access could result in data breaches, triggering mandatory breach notification requirements and potential fines.

Mitigation Strategies
  • Upgrade MPXJ to version 16.4.1 or later to patch the XXE vulnerability.
  • Avoid processing untrusted Merlin project files or SQLite databases.
  • Preprocess SQLite databases to remove doctype declarations if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61570. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart