XXE Vulnerability in MPXJ MerlinReader

The MPXJ project library contains an XML External Entity (XXE) injection vulnerability (CVE-2026-61570) within its MerlinReader component. The issue originates from the use of default DocumentBuilder configurations that do not disable Document Type Definition (DTD) processing when parsing XML content stored in the ZTIMEINTERVALS column of Merlin project SQLite files.

An attacker can supply a malicious Merlin project file containing a crafted XML payload to trigger the vulnerability. While the current processing logic within MPXJ limits the ability to exfiltrate the contents of the read files, the vulnerability exposes local system files to unauthorized access. This issue affects multiple language ports including Maven, RubyGems, NuGet, and Python/pip packages for MPXJ versions 5.5.5 through 16.4.0. Users are advised to upgrade to MPXJ 16.4.1 or later to resolve this vulnerability.

Impact

The vulnerability allows an attacker to perform arbitrary file reads on the system where the MPXJ library parses untrusted Merlin project files. While successful exploitation is hindered by subsequent application logic preventing direct exfiltration of the data, it represents a high-severity security risk for any software component or enterprise application utilizing MPXJ to process external Merlin project files.

Recommendation

• Upgrade all instances of MPXJ to version 16.4.1 or later to remediate CVE-2026-61570.
• Implement strict validation of Merlin project files before ingestion into any application utilizing the MPXJ library.
• If upgrading is not immediately possible, implement pre-processing steps to strip doctype declarations from the ZTIMEINTERVALS column of Merlin SQLite databases prior to passing them to the reader.