CVE-2022-41954

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permissions `-rw-r--r--`. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set `java.io.tmpdir` to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

• CWE-200
• CWE-377
• CWE-668

• https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721
• https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849gThird Party Advisory
• https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721
• https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849gThird Party Advisory

Published

Nov 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41949DHIS 2 is an open source information system for data capture…4.3
• CVE-2022-4195Insufficient policy enforcement in Safe Browsing in Google C…4.3
• CVE-2022-41950super-xray is the GUI alternative for vulnerability scanning…7.8
• CVE-2022-41951OroPlatform is a PHP Business Application Platform (BAP) des…9.8
• CVE-2022-41952Synapse before 1.52.0 with URL preview functionality enabled…5.3
• CVE-2022-41953Git GUI is a convenient graphical tool that comes with Git f…7.8
• CVE-2022-41955Autolab is a course management service, initially developed …8.8
• CVE-2022-41956Autolab is a course management service, initially developed …6.5
• CVE-2022-41957Muhammara is a node module with c/cpp bindings to modify PDF…7.5
• CVE-2022-41958super-xray is a web vulnerability scanning tool. Versions pr…7.8
• CVE-2022-4196The Multi Step Form WordPress plugin before 1.7.8 does not s…4.8
• CVE-2022-41960BigBlueButton is an open source web conferencing system. Ver…4.3