Description
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache-poi-java | 3.10.1-1 | — |
| Debian 13 | libapache-poi-java | 3.10.1-1 | — |
| Debian 12 | libapache-poi-java | 3.10.1-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.poi:poi | < 3.10.1 | 3.10.1 | GHSA-q56h-jjj6-52mf |
Advisories 1
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21996759
- http://poi.apache.org/changes.html
- 78018 vdb-entry
- 61766 third-party-advisory
- https://lucene.apache.org/solr/solrnews.html#18-august-2014-recommendation-to-update-apache-poi-in-apache-solr-480-481-and-490-installations
- apache-poi-cve20143529-info-disc(95770) vdb-entry
- RHSA-2014:1370 vendor-advisory
- http://www.apache.org/dist/poi/release/RELEASE-NOTES.txt
- 60419 third-party-advisory
- RHSA-2014:1400 vendor-advisory
- 69647 vdb-entry
- RHSA-2014:1398 vendor-advisory
- 59943 third-party-advisory
- RHSA-2014:1399 vendor-advisory