Improper Input Validation in Apache POI: libapache-poi-java Vulnerability
Summary
DEBIAN-CVE-2025-31672: Improper Input Validation vulnerability in Apache POI. Affects libapache-poi-java versions 4.0.1-1 – 4.0.1-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libapache-poi-java is a Java library used for reading and writing Microsoft Office documents, including formats like XLSX, DOCX, and PPTX. It is widely utilized in applications that require document manipulation and generation. However, it has been found to have a vulnerability that affects its ability to properly validate input from OOXML format files, which can lead to unpredictable behavior when processing files with duplicate zip entries.
Vulnerability Detail
The vulnerability arises from improper input validation in Apache POI, specifically in the parsing of OOXML format files such as xlsx, docx, and pptx. These file formats are essentially zip files, and malicious users can exploit this by adding zip entries with duplicate names. When the affected file is read, different products may select different zip entries, leading to inconsistent data being read. This issue affects versions of poi-ooxml prior to 5.4.0, which has introduced a check to throw an exception if duplicate file names are detected.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing OOXML files that may contain duplicate zip entries until the package is updated. Additionally, validate the contents of OOXML files before processing them to ensure they do not contain duplicate names.
Conclusion
The improper input validation vulnerability in libapache-poi-java poses a significant risk when processing OOXML files. Users are strongly advised to upgrade to version 5.4.0 or later to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libapache-poi-java →
FAQ
The vulnerability is due to improper input validation when parsing OOXML files, which can lead to inconsistent data being read from files with duplicate zip entries.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your manifest file like package-lock.json, you can determine if your application is affected.
The consequences include the possibility of applications reading incorrect or inconsistent data from OOXML files, which can lead to data integrity issues.
Yes, the issue is fixed in version 5.4.0 of poi-ooxml. It is recommended to upgrade to this version or later.
For more information, you can visit the Apache POI security page at https://poi.apache.org/security.html.
References
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
