net.sf.mpxj:mpxj

MPXJ is a library which allows you to read, manipulate, and write project information from Java, .Net, Python and Ruby. MPXJ supports a range of data formats: Microsoft Project Exchange (MPX), Microsoft Project (MPP, MPT), Microsoft Project Data Interchange (MSPDI XML), Microsoft Project Database (MPD), Planner (XML), Primavera P6 (PMXML, XER, and database), Primavera P3, Primavera Suretrak, Asta Powerproject (PP, MDB), Asta Easyplan (PP), Phoenix Project Manager (PPX), FastTrack Schedule (FTS), Ganttproject (GAN), Turboproject (PEP), Conceptdraw PROJECT (CDPX, CDPZ, CDPTZ), Synchro Scheduler (SP) Gantt Designer (GNT), Standard Data Exchange Format (SDEF), Project Commander (PC), Deltek Open Plan (BK3), and Edraw Project (EDPX). MPXJ can also read project data from Microsoft Project Server, Primavera P6 Web Services (P6 EPPM), and Oracle Primavera Cloud (OPC).

Latest 16.9.0

Maven

96%

Total Score

Maintainer Stability

100

Dependencies

Maturity

100

Supply Chain

100

Are you affected? Scan for Free

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-68065 mpxj is vulnerable to Path Traversal in versions 7.3.0 - 16.4.1.	7.3.0 - 16.4.1	Medium
AIKIDO-2026-358292 mpxj is vulnerable to XML External Entity (XXE) Injection in versions 5.5.5 - 16.4.0.	5.5.5 - 16.4.0	High
AIKIDO-2026-417987 mpxj is vulnerable to Insecure Temporary File in versions 7.3.0 - 16.5.0.	7.3.0 - 16.5.0	Low
CVE-2024-49771 net.sf.mpxj:mpxj is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 8.3.5 - 13.5.1.	8.3.5 - 13.5.1	Medium
CVE-2022-41954 net.sf.mpxj:mpxj is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.0.0 - 10.14.1.	0.0.0 - 10.14.1	Low

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
org.apache.poi:poi Version 5.5.1	—	—
org.xerial:sqlite-jdbc Version 3.51.2.0	—	—
com.jgoodies:jgoodies-binding Version 2.13.0	—	—
com.github.joniles:rtfparserkit Version 1.16.0	—	—
jakarta.xml.bind:jakarta.xml.bind-api Version 3.0.1	—	—