Improper Input Validation in Apache POI - libapache-poi-java Vulnerability
Summary
CVE-2025-31672: Improper Input Validation vulnerability in Apache POI. Affects libapache-poi-java versions < 76f113564fe70417fac1ff8dbb350a0b32f373c8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache POI is a widely used Java library that enables the manipulation of various document formats, including Microsoft Office files such as Excel, Word, and PowerPoint. The library provides a robust API for reading and writing these file formats, making it essential for applications that require document processing capabilities. However, a recent vulnerability has been identified in the handling of OOXML format files, specifically those with duplicate zip entry names, which can lead to unpredictable behavior when parsing these files.
Vulnerability Detail
The vulnerability, identified as CVE-2025-31672, stems from improper input validation in Apache POI's parsing mechanism for OOXML files (like xlsx, docx, and pptx). Malicious users can exploit this vulnerability by creating zip files with duplicate entry names, which can cause different applications to read varying data from the same file. This inconsistency can lead to data integrity issues and unexpected behavior in applications relying on Apache POI for document processing.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually inspect and validate OOXML files to ensure that there are no duplicate zip entry names before processing them with Apache POI. This can be done by unzipping the files and checking the contents for duplicates.
Conclusion
In summary, CVE-2025-31672 is a significant vulnerability in Apache POI that can lead to data inconsistencies when processing OOXML files. Users are strongly encouraged to upgrade to version 5.4.0 or later to mitigate this risk. For those unable to upgrade immediately, manual validation of files is recommended as a temporary measure.
See every vulnerability recorded for libapache-poi-java →
FAQ
CVE-2025-31672 is a vulnerability in Apache POI that arises from improper input validation when parsing OOXML files, allowing for potential data inconsistency.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include potential data integrity issues and unpredictable behavior in applications that rely on Apache POI for document processing.
Yes, upgrading to Apache POI version 5.4.0 or later addresses this vulnerability by implementing checks for duplicate zip entries.
If an immediate upgrade is not possible, manually inspect OOXML files for duplicate zip entry names as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
