MPXJ, a Java library for reading and writing project plan files, contains a path‑traversal vulnerability in its Primavera P3 PRX and SureTrak STX reader modules. When a specially crafted PRX or STX file is loaded, the library writes files to arbitrary locations on the host file system. The flaw allows an attacker to overwrite any writable file, potentially replacing critical configuration documents or inserting malicious executables, thereby compromising data integrity and possibly enabling further attacks. The weakness is documented as CWE‑22.

The affected product is the MPXJ library released by joniles. Versions from 7.3.0 up to, but not including, 16.5.0 are vulnerable. Any Java application or service that incorporates these library versions and processes external PRX or STX files is at risk. The bug was fixed by version 16.5.0.

The CVSS score of 5.3 indicates a moderate risk that hinges on the ability to supply a malicious file to the application. EPSS data is not available, so the expected exploitation probability cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local or remote, depending on whether the application accepts uploaded files or parses files from external sources. An attacker who can provide a crafted file to the library can trigger the arbitrary file write. Prompt patching is therefore essential to eliminate this exposure.