XML injection (XXE) In org.apache.poi:poi-ooxml
Description
Improper Restriction of XML External Entity Reference in Apache POI In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 4.1.1 | ||
 debian 12 | - | ||
debian 14 | - | ||
maven | 4.1.1 | ||
debian 13 | - | ||
debian 11 | - |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13.