CVE-2026-61570 is an XML External Entity (XXE) vulnerability in the joniles MPXJ library affecting versions >=5.5.5 and <16.4.1. The MerlinReader creates a DocumentBuilder with default settings that enable doctype declarations and external entities when parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database. This improper restriction allows a crafted database to cause the XML parser to read arbitrary local files. However, MPXJ's subsequent XML handling makes actual disclosure of file contents unlikely. The vulnerability is addressed in version 16.4.1.

An attacker can craft a malicious Merlin project SQLite database that causes the XML parser to read arbitrary local files on the system where MPXJ is used. While this can lead to local file reading, the likelihood of file content disclosure is low due to how MPXJ processes the parsed XML. The vulnerability does not affect integrity or availability, only confidentiality to some extent.

This vulnerability is fixed in MPXJ version 16.4.1. Users should upgrade to version 16.4.1 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.