What’s Vulnerable › Vulnerabilities

CVE-2020-35460

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-14 · updated 2026-06-17
• Weakness: CWE-22

Description

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

Affected products

• joniles mpxj: before 8.3.5 — fixed in 8.3.5
• Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12, 21.12

How to fix

Upgrade to a fixed version: joniles mpxj 8.3.5. Check the vendor advisory for mitigations.

References

• http://www.mpxj.org/changes-report.html#a8.3.5
• https://github.com/joniles/mpxj/commit/8eaf4225048ea5ba7e59ef4556dab2098fcc4a1d
• https://www.oracle.com/security-alerts/cpujan2021.html
• http://www.mpxj.org/changes-report.html#a8.3.5
• https://github.com/joniles/mpxj/commit/8eaf4225048ea5ba7e59ef4556dab2098fcc4a1d
• https://www.oracle.com/security-alerts/cpujan2021.html

Get alerted when CVE-2020-35460 or the next vulnerability affects your stack