Improper Input Validation in Apache POI: libapache-poi-java Vulnerability
Summary
UBUNTU-CVE-2025-31672: Improper Input Validation vulnerability in Apache POI. Affects libapache-poi-java versions 3.10.1-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache POI is a popular Java library used for reading and writing Microsoft Office file formats, including Excel, Word, and PowerPoint. The library allows developers to manipulate these file types programmatically, making it essential for applications that require document generation or data extraction. However, a recent vulnerability has been identified in the handling of OOXML format files, which could lead to unpredictable behavior when processing files with duplicate zip entries.
Vulnerability Detail
The vulnerability, identified as CVE-2025-31672, arises from improper input validation in Apache POI's handling of OOXML files (like xlsx, docx, and pptx). These file formats are essentially zip files, and malicious users can exploit this by including zip entries with duplicate names. This can lead to different applications reading different data from the same file, as they may select different zip entries based on their internal logic. The issue affects versions of Apache POI prior to 5.4.0, which introduced a check to throw an exception when duplicate file names are detected.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can validate the contents of OOXML files before processing them to ensure there are no duplicate zip entries. This can be done by manually inspecting the zip structure or using a script to check for duplicate file names within the zip.
Conclusion
The improper input validation vulnerability in Apache POI's handling of OOXML files poses a risk of data inconsistency and unpredictable behavior in applications that rely on this library. Users are strongly advised to upgrade to version 5.4.0 or later to mitigate this risk.
See every vulnerability recorded for libapache-poi-java →
FAQ
CVE-2025-31672 is a vulnerability in Apache POI that involves improper input validation when parsing OOXML files, potentially leading to data inconsistency.
If your application uses Apache POI to process OOXML files, it may read incorrect data if the files contain duplicate zip entries, leading to unpredictable behavior.
Versions of Apache POI prior to 5.4.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
