Improper Input Validation in Apache POI Affecting OOXML File Parsing

CVE-2025-31672

Summary

An improper input validation vulnerability exists in Apache POI affecting the processing of OOXML format files such as xlsx, docx, and pptx. Due to the ZIP file structure of these formats, malicious users can insert duplicate entries with the same name, causing inconsistencies during file reading. Products utilizing Apache POI may inadvertently select different data based on varying zip entry resolutions. To mitigate this issue, users are advised to upgrade to version poi-ooxml 5.4.0, which implements a check for duplicate zip entries and prevents this vulnerability. Further secure usage of POI libraries is recommended in the vendor's security advice.

References