CVE-2016-5000: Improper Restriction of XML External Entity Reference in Apache POI
Summary
CVE-2016-5000: Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability. Affects org.apache.poi:poi-examples versions < 3.14. Fixed in 3.14. How to fix ↓
Also tracked for
- libapache-poi-java · Debian:11
The same CVE-2016-5000 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache POI is a popular Java library used for reading and writing Microsoft Office file formats, including Excel spreadsheets. It provides APIs to manipulate and extract data from these files. However, prior to version 3.14, Apache POI was vulnerable to an XML External Entity (XXE) issue in the XLSX2CSV example. This vulnerability allowed remote attackers to read arbitrary files by exploiting a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference.
Vulnerability Detail
The vulnerability in Apache POI arises from improper restriction of XML external entity references. By leveraging this vulnerability, an attacker can manipulate the XML parsing process and read arbitrary files on the system. This can lead to unauthorized access to sensitive information, such as configuration files, credentials, or other confidential data. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Latest published version: 6.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Apache POI is not feasible, a possible workaround is to disable the XLSX2CSV example or any functionality that relies on it. By removing or disabling the vulnerable code, the risk of exploitation can be mitigated. However, this workaround may impact the functionality of the affected feature.
Conclusion
The vulnerability in Apache POI, identified as CVE-2016-5000, allows remote attackers to read arbitrary files on the system by exploiting XML external entity references. To mitigate this vulnerability, it is recommended to upgrade to Apache POI version 3.14 or later. Alternatively, disabling the XLSX2CSV example or any functionality that relies on it can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.poi:poi-examples →
FAQ
Apache POI is a Java library for working with Microsoft Office file formats, such as Excel spreadsheets.
The XLSX2CSV example is a utility provided by Apache POI to convert Excel files in the XLSX format to CSV (Comma-Separated Values) format.
An XML External Entity (XXE) issue is a vulnerability that allows an attacker to read arbitrary files on a system by exploiting the processing of external entities in XML parsing.
This vulnerability can lead to unauthorized access to sensitive information, such as configuration files, credentials, or other confidential data stored in the system.
This vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
