Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

org.apache.poi:poi-examples (3.7-beta2) potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.7-beta2)

org.apache.poi:poi-ooxml MAVEN version 3.7-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - org.apache.poi:poi-examples 3.7-beta2 Source cves: CVE-2025-31672 Source advisory: OSV:GHSA-GMG8-593G-7MV3...

com.qaprosoft:carina-dataprovider (>=5.2.1.30, <=6.4.36), org.apache.poi:poi-examples (3.11-beta3) +1 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.11-beta3)

org.apache.poi:poi-ooxml MAVEN version 3.11-beta3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - com.qaprosoft:carina-dataprovider =5.2.1.30, =6.4.36 - org.apache.poi:poi-examples 3.11-beta3 -...

br.com.jarch:jarch-annotation (>=2.23.5, <=20.2.0), br.com.jarch:jarch-apt (>=2.23.5, <=25.11.0) +214 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.12)

org.apache.poi:poi-ooxml MAVEN version 3.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - br.com.jarch:jarch-annotation =2.23.5, =2.23.5, =19.1.0, =2.23.5, =2.23.5, =20.3.0, =2.23.5, =2.23.5, =24.2.0,...

br.com.digix:editordedocumento (>=1.1.8, <=2.4.0), br.com.tecsinapse:tecsinapse-data-io (>=2.0.0, <=3.0.3-b) +219 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.14)

org.apache.poi:poi-ooxml MAVEN version 3.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - br.com.digix:editordedocumento =1.1.8, =2.0.0, =1.0.0, =0.0.3, =0.3.0, =v1.0.13oldrzm, =v1.0.13oldrzm,...

cn.mapway:mapway-doc-ui (>=0.r.33, <=0.0.31), cn.mapway:mapway-maven-plugin (>=0.0.2, <=0.0.3) +16 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.15-beta2)

org.apache.poi:poi-ooxml MAVEN version 3.15-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - cn.mapway:mapway-doc-ui =0.r.33, =0.0.2, =1.1, =1.0.0, =2016.7.5, =2016.7.5, =2016.7.5, =2016.7.5, =2.0.0,...

com.hack23.cia:service.component.agent.impl (>=2017.2.24, <=2017.4.15), com.hack23.cia:service.data.impl (>=2017.2.24, <=2017.4.15) +16 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.16-beta2)

org.apache.poi:poi-ooxml MAVEN version 3.16-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - com.hack23.cia:service.component.agent.impl =2017.2.24, =2017.2.24, =2017.2.24, =2017.2.24, =1.0.0, =1.0.4...

cn.alphabets.light:lightcore-java (1.1.0), cn.chenhuanming:octopus (>=1.1.0, <=1.1.4) +351 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.16)

org.apache.poi:poi-ooxml MAVEN version 3.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - cn.alphabets.light:lightcore-java 1.1.0 - cn.chenhuanming:octopus =1.1.0, =0.0.5, =0.0.5, =0.0.5, =3.3,...

com.epam.reportportal:service-authorization (>=3.1.2, <=4.1.0), com.github.iamshreeram.plugins.jmeter.functions:slack-notifier (1.0) +60 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.17-beta1)

org.apache.poi:poi-ooxml MAVEN version 3.17-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - com.epam.reportportal:service-authorization =3.1.2, =1.9.0, =2.8.0, =2.8.0, =1.0.9-3.3, =1.0.1, =1.0.3 and...

ai.stainless:grails-tika (0.1.0), br.com.tecsinapse:tecsinapse-data-io (>=3.1.3, <=3.1.8) +540 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (4.0.1)

org.apache.poi:poi-ooxml MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - ai.stainless:grails-tika 0.1.0 - br.com.tecsinapse:tecsinapse-data-io =3.1.3, =0.0.2, =0.1.28, =0.0.1, =2.0,...

org.apache.poi:poi-examples (3.11-beta1), org.apache.poi:poi-excelant (3.11-beta1) potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.11-beta1)

org.apache.poi:poi-ooxml MAVEN version 3.11-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - org.apache.poi:poi-examples 3.11-beta1 - org.apache.poi:poi-excelant 3.11-beta1 Source cves: CVE-2025-3167...

com.deepoove:poi-tl (0.0.3), com.github.kulya:jmeter-gradle-plugin (1.3.4-2.12) +25 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.11-beta2)

org.apache.poi:poi-ooxml MAVEN version 3.11-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - com.deepoove:poi-tl 0.0.3 - com.github.kulya:jmeter-gradle-plugin 1.3.4-2.12 -...

at.iem:sysson_2.10 (1.12.0), at.iem:sysson_2.11 (>=1.10.2, <=1.12.0) +456 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.13)

org.apache.poi:poi-ooxml MAVEN version 3.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - at.iem:sysson2.10 1.12.0 - at.iem:sysson2.11 =1.10.2, =0.3.1, =0.3.1, =3.6.1, =3.6.1, =3.6.1, =3.6.1, =3.6.1,...

com.hack23.cia:service.component.agent.impl (>=2016.2.7, <=2016.3.7), com.hack23.cia:service.data.impl (>=2016.2.7, <=2016.3.7) +4 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.14-beta1)

org.apache.poi:poi-ooxml MAVEN version 3.14-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - com.hack23.cia:service.component.agent.impl =2016.2.7, =2016.2.7, =2016.2.7, =2016.2.7, =2016.3.7 -...

be.atbash.test:integration-testing-database (>=1.2.0, <=2.2.0), cn.afterturn:easypoi-base (>=4.1.0, <=4.1.3) +374 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (4.1.0)

org.apache.poi:poi-ooxml MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - be.atbash.test:integration-testing-database =1.2.0, =4.1.0, =4.1.0, =4.1.0, =1.0.1, =0.0.4, =1.0.0, =1.0.0,...

builders.dsl:spreadsheet-builder-google (2.2.1), builders.dsl:spreadsheet-builder-poi (2.2.1) +610 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (4.1.1)

org.apache.poi:poi-ooxml MAVEN version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - builders.dsl:spreadsheet-builder-google 2.2.1 - builders.dsl:spreadsheet-builder-poi 2.2.1 - cc.hiver:hiver-cor...

ai.mattmann.mnemosyne:cas-crawler (1.11.0), ai.mattmann.mnemosyne:cas-filemgr (1.11.0) +122 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.15-beta1)

org.apache.poi:poi-ooxml MAVEN version 3.15-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - ai.mattmann.mnemosyne:cas-crawler 1.11.0 - ai.mattmann.mnemosyne:cas-filemgr 1.11.0 -...

at.iem:sysson_2.11 (>=1.13.0, <=1.17.0), at.iem:sysson_2.12 (>=1.13.0, <=1.17.0) +537 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.15)

org.apache.poi:poi-ooxml MAVEN version 3.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - at.iem:sysson2.11 =1.13.0, =1.13.0, =1.37, =3.6.1, =3.11.0, =2.0.6, =3.0.1, =0.1, =3.0.1, =1.0.3, =1.0.5-c and...

com.coreoz:ppt-templates (>=1.0.0-beta1, <=1.0.0), com.coreoz:windmill (>=1.0.0-rc1, <=1.0.0-rc2) +16 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.16-beta1)

org.apache.poi:poi-ooxml MAVEN version 3.16-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - com.coreoz:ppt-templates =1.0.0-beta1, =1.0.0-rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0,...

be.siteware:excelprocessor (1.0.4), br.eti.clairton:migrator (>=1.6.0, <=1.6.4) +2016 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.17)

org.apache.poi:poi-ooxml MAVEN version 3.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - be.siteware:excelprocessor 1.0.4 - br.eti.clairton:migrator =1.6.0, =1.0.0, =3.0.0, =3.20.0, =3.20.0, =3.20.0,...