Input validation error in Apache POI

1) Input validation error

EUVDB-ID: #VU112257

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-31672

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to manipulate file parsing behavior.

The vulnerability stems from the way Apache POI handles zip entries in OOXML format files. When duplicate file names (including paths) exist within the zip structure, different products may select different zip entries with the same name, leading to inconsistent data interpretation. A remote attacker can manipulate file parsing behavior through specially crafted OOXML files containing ZIP entries with duplicate file names. This manipulation can result in inconsistent data processing across different systems, potentially leading to security issues and data integrity concerns.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Apache POI: 0.1 - 5.3.1

CPE2.3

• cpe:2.3:a:apache_foundation:poi-scratchpad:0.1:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:poi-scratchpad:0.2:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:poi-scratchpad:0.3:*:*:*:*:*:*:*

External links

https://www.openwall.com/lists/oss-security/2025/04/08/2
https://bz.apache.org/bugzilla/show_bug.cgi?id=69620
https://lists.apache.org/thread/k14w8vcjqy4h34hh5kzldko78kpylkq5
https://security.netapp.com/advisory/ntap-20250523-0004/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.