MPXJ, an open‑source library for reading and writing project plans, contains a flaw in the MerlinReader that processes XML stored in a SQLite database. When parsing the ZTIMEINTERVALS column, the library creates a DocumentBuilder with default settings that leave doctype declarations and external entities enabled. This allows an attacker who can supply or modify a Merlin project database to craft XML that causes the parser to read an arbitrary local file. The vulnerability exploits CWE‑611: Improper Restriction of XML External Entity Reference. While the library’s subsequent handling of the XML offers little chance of revealing the file’s contents, the risk of sensitive data disclosure remains.

The issue affects the joniles MPXJ library versions from 5.5.5 up to 16.4.0. Any application that incorporates these library versions and processes Merlin project files from potentially untrusted sources is susceptible. The flaw is resolved in version 16.4.1, which disables the vulnerable XML configuration.

The CVSS base score of 7.5 signals a high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The attack vector requires the attacker to supply a malicious Merlin project database, limiting the risk to environments that accept untrusted Merlin data. In such scenarios, an attacker could trigger the library to read local files on the host running the Java process.