CVE-2024-49771 MPXJ has a Potential Path Traversal Vulnerability
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-49771?
CVE-2024-49771 is a medium-severity vulnerability in joniles mpxj, published on 28 Oct 2024.
Official description
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.
Weakness: CWE-22
Which versions are affected by CVE-2024-49771?
15 open source packages ship an affected version, including mpxj, net.sf.mpxj:mpxj and MPXJ.Net.
| Package | Affected | Fixed in |
|---|---|---|
mpxj PyPI | From 8.3.5 | 13.5.1 |
mpxj PyPI | From 8.3.5 | 13.5.1 |
mpxj PyPI | From 8.3.5 | 13.5.1 |
mpxj RubyGems | From 8.3.5 | 13.5.1 |
mpxj RubyGems | From 8.3.5 | 13.5.1 |
net.sf.mpxj:mpxj Maven | From 8.3.5 | 13.5.1 |
9 more packages
net.sf.mpxj:mpxj Maven | From 8.3.5 | 13.5.1 |
MPXJ.Net NuGet | From 13.0.0 | 13.5.1 |
MPXJ.Net NuGet | From 13.0.0 | 13.5.1 |
net.sf.mpxj NuGet | From 8.3.5 | 13.5.1 |
net.sf.mpxj NuGet | From 8.3.5 | 13.5.1 |
net.sf.mpxj-for-csharp NuGet | From 8.3.5 | 13.5.1 |
net.sf.mpxj-for-csharp NuGet | From 8.3.5 | 13.5.1 |
net.sf.mpxj-for-vb NuGet | From 8.3.5 | 13.5.1 |
net.sf.mpxj-for-vb NuGet | From 8.3.5 | 13.5.1 |
How do I fix CVE-2024-49771?
Upgrade mpxj to 13.5.1 or later.
Is CVE-2024-49771 being exploited?
There is no known exploitation of CVE-2024-49771 in the wild and no public exploit code.
Sources
Also known as GHSA-j945-c44v-97g6, PYSEC-2026-1681.