org.apache.tika:tika (0.3) potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.5-beta5)

org.apache.poi:poi-ooxml MAVEN version 3.5-beta5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - org.apache.tika:tika 0.3 Source cves: CVE-2025-31672 Source advisory: OSV:GHSA-GMG8-593G-7MV3...

org.apache.jackrabbit:jackrabbit-core (>=2.0-beta1, <=2.0-beta3), org.apache.jackrabbit:jackrabbit-jca (>=2.0-beta1, <=2.0-beta3) +7 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.5-beta6)

org.apache.poi:poi-ooxml MAVEN version 3.5-beta6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - org.apache.jackrabbit:jackrabbit-core =2.0-beta1, =2.0-beta1, =2.0-beta1, =1.4.0, =1.4.0.1, =1.4.1.0,...

ai.chat2db.excel:easyexcel-plus (0.0.1), ai.chat2db.excel:easyexcel-plus-core (0.0.1) +3616 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (>=5.0.0, <=5.3.0)

org.apache.poi:poi-ooxml MAVEN version =5.0.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =1.0.0, =0.5.1, =1.1.0 and more Source cves: CVE-2025-31672 Source advisory: SNYK:JAVA-ORGAPACHEPOI-9685010...

org.apache.poi:poi-examples (3.8-beta2), org.apache.poi:poi-excelant (3.8-beta2) potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.8-beta2)

org.apache.poi:poi-ooxml MAVEN version 3.8-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - org.apache.poi:poi-examples 3.8-beta2 - org.apache.poi:poi-excelant 3.8-beta2 Source cves: CVE-2025-31672...

org.apache.nifi:nifi-media-nar (>=0.7.0, <=1.4.0), org.apache.nifi:nifi-media-processors (>=0.7.0, <=1.4.0) +16 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.12-beta1)

org.apache.poi:poi-ooxml MAVEN version 3.12-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - org.apache.nifi:nifi-media-nar =0.7.0, =0.7.0, =2.6.0, =4.4.0.final, =4.4.0.final, =4.4.0.final,...

com.findwise.hydra:hydra-tika-stages (>=0.2.0, <=0.5.0), it.unimi.di:archive4j (1.3) +33 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.8-beta5)

org.apache.poi:poi-ooxml MAVEN version 3.8-beta5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - com.findwise.hydra:hydra-tika-stages =0.2.0, =5.0, =4.0.0-alpha, =4.0.0-alpha, =4.0.0-alpha, =0.10, =0.10,...

fr.pilato.elasticsearch.crawler:fscrawler (2.0.0), org.apache.poi:poi-examples (3.13-beta1) +57 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.13-beta1)

org.apache.poi:poi-ooxml MAVEN version 3.13-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - fr.pilato.elasticsearch.crawler:fscrawler 2.0.0 - org.apache.poi:poi-examples 3.13-beta1 -...

CVE-2025-31672

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

ae.teletronics.nlp:entityextraction (>=1.3, <=1.4), ai.chat2db.excel:easyexcel-plus (0.0.1) +10008 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (>=3.5-beta5, <=5.3.0)

org.apache.poi:poi-ooxml MAVEN version =3.5-beta5, =1.3, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =1.0.0, =1.1.0 and more Source cves: CVE-2025-31672 Source advisory: MEND:CVE-2025-31672...

CVE-2025-31672

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672 Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672

The Apache POI library's poi-ooxml component (versions before 5.4.0 ) is vulnerable to an Improper Input Validation issue (CWE-20 ) when parsing OOXML files (e.g., xlsx , docx , pptx ). Malicious users can include zip entries with duplicate names , causing different products to potentially read d...

CVE-2025-31672 Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672 Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672: Improper Input Validation

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

PT-2025-15634 · Apache +1 · Apache Poi +1

Name of the Vulnerable Software and Affected Versions: Apache POI affected versions not specified Description: The issue concerns the parsing of OOXML based files, such as xlsx and docx, by the poi-ooxml component. It can read unexpected data if the underlying zip file has duplicate zip entry...

Exploit for Race Condition in Microsoft

CVE-2023-36884: MS Office HTML RCE with crafted documents On...

The Tale of Two Exploits - Breaking Down CVE-2023-36884 and the Infection Chain

The Tale of Two Exploits - Breaking Down CVE-2023-36884 and the Infection Chain By Trellix · August 24, 2023 This blog was written by Chintan Shah Executive Summary On July 11 2023, Microsoft released a patch fixing multiple actively exploited RCE vulnerabilities and disclosed a phishing campaign...

The Tale of Two Exploits - Breaking Down CVE-2023-36884 and the Infection Chain

The Tale of Two Exploits - Breaking Down CVE-2023-36884 and the Infection Chain By Chintan Shah · August 24, 2023 Executive Summary On July 11 2023, Microsoft released a patch fixing multiple actively exploited RCE vulnerabilities and disclosed a phishing campaign conducted by the threat actor,...

Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable poi-ooxml-3.9.jar

Summary Atlas eDiscovery Process Management is affected by a vulnerable poi-ooxml-3.9.jar. Hence poi-ooxml-3.9.jar upgraded to poi-ooxml-4.0.jar to fix vulnerabilities. Vulnerability Details CVEID:CVE-2017-5644 DESCRIPTION: Apache POI is vulnerable to a denial of service, cause by an XML External...