Bug 2538784 (CVE-2026-61570)

Summary: CVE-2026-61570 net.sf.mpxj/mpxj: MPXJ: Information disclosure via XML External Entity (XXE) vulnerability in MerlinReader.
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in MPXJ. The MerlinReader component, when processing XML from a Merlin project SQLite database, is vulnerable to an XML External Entity (XXE) attack due to default settings that enable doctype declarations and external entities. A remote attacker could exploit this by providing a specially crafted database, which would cause the parser to read arbitrary local files. While the direct disclosure of file contents is unlikely, this vulnerability could still lead to unintended information exposure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2539350    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-22 20:36:43 UTC 
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled. A crafted database can cause the parser to read an arbitrary local file, although MPXJ's subsequent handling of the parsed XML makes disclosure of the file contents unlikely. This issue is fixed in version 16.4.1.