Meta tags:

Headings (most frequently used words):

poi, cve, apache, 2021, 2025, to, in, 2019, 11, versions, prior, api, for, november, available, log4j, march, 2022, january, xml, external, entity, xxe, processing, xmlbeans, the, java, microsoft, documents, project, news, mission, statement, contributing, 30, july, source, repository, switched, from, subversion, git, april, 31672, improper, input, validation, vulnerability, before, 2024, avoid, 24, 26336, carefully, crafted, tnef, file, can, cause, an, out, of, memory, exception, scratchpad, 10, 16, 18, december, vulnerabilities, 44228, 45046, and, 45105, 13, 23926, 20, october, 12415, 26, initial, support, jdk, why, should, use, components,

Text of the page (most frequently used words):
the (80), poi (43), and (36), apache (35), for (22), you (19), this (16), xmlbeans (15), #project (14), java (14), log4j (14), are (13), use (13), file (13), api (13), read (12), files (12), using (11), format (11), which (10), that (10), excel (9), ooxml (9), #microsoft (9), xml (9), issue (9), cve (9), with (8), version (8), users (8), write (7), document (7), when (6), from (6), not (6), office (6), ole2 (6), can (6), available (6), release (6), fixes (6), external (6), entity (6), 2021 (6), software (5), git (5), xlsx (5), allows (5), poifs (5), should (5), support (5), based (5), affected (5), versions (5), security (5), 2025 (5), foundation (4), our (4), your (4), bug (4), have (4), source (4), repository (4), component (4), some (4), hssf (4), xls (4), all (4), there (4), memory (4), other (4), projects (4), provide (4), open (4), tnef (4), has (4), application (4), formats (4), documents (4), 2019 (4), changes (4), was (4), vulnerability (4), crafted (4), xxe (4), processing (4), their (4), scratchpad (4), exception (4), used (4), subversion (4), dev (3), please (3), like (3), need (3), help (3), provides (3), include (3), components (3), needed (3), xssf (3), ole (3), compound (3), most (3), such (3), also (3), apis (3), uses (3), list (3), team (3), references (3), mitigation (3), before (3), advised (3), update (3), description (3), prior (3), above (3), could (3), any (3), core (3), dependencies (3), latest (3), only (3), vulnerabilities (3), same (3), cause (3), out (3), entries (3), zip (3), more (3), about (2), org (2), logo (2), contribution (2), ready (2), guidelines (2), working (2), time (2), download (2), code (2), several (2), page (2), implementation (2), had (2), written (2), mfc (2), complete (2), date (2), why (2), text (2), extraction (2), collaborate (2), them (2), hmef (2), october (2), 2007 (2), welcome (2), outlook (2), level (2), work (2), powerpoint (2), word (2), standards (2), found (2), 2008 (2), docx (2), pptx (2), well (2), filesystem (2), mission (2), see (2), details (2), january (2), requires (2), newer (2), since (2), issues (2), summary (2), people (2), interested (2), follow (2), track (2), progress (2), notes (2), codebase (2), pleased (2), announce (2), march (2), attack (2), discovered (2), who (2), tool (2), xssfexporttoxml (2), user (2), specially (2), attacker (2), via (2), fixed (2), years (2), parsing (2), recommend (2), they (2), upgrade (2), recommended (2), package (2), carefully (2), 2022 (2), while (2), avoid (2), november (2), 31672 (2), name (2), products (2), different (2), duplicate (2), input (2), mirror (2), github (2), switched (2), home (2), send, feedback, website, copyright, 2001, 2026, trademarks, submit, patch, database, contribute, great, enthusiastic, hard, talented, folks, matter, background, motivated, join, happy, get, started, mailing, lists, build, contributing, modules, may, interest, information, determine, jar, classpath, combined, interface, easily, kinds, additionally, specialized, sxssf, very, large, optimized, way, probably, alternatively, inter, operate, running, windows, platform, just, bragging, say, correct, major, applications, web, spiders, index, builders, content, management, systems, general, policy, much, possible, functionality, examples, serializers, whom, documenting, interpretors, practical, donate, directly, those, enabling, lucene, tika, cocoon, publisher, hpbf, visio, hdgf, xdgf, opened, specifications, would, contributions, hsmf, each, exists, module, attempts, common, high, both, developed, progressing, presentations, hslf, xslf, hwpf, xwpf, workbooks, openxml, new, includes, low, packaging, conventions, openxml4j, doc, ppt, serialization, properties, hpsf, create, maintain, manipulating, various, upon, short, addition, solution, porting, others, participate, statement, faq, entry, did, verify, compilation, unit, tests, pass, initial, jdk, been, reopened, feel, free, jira, unretired, maintaining, sub, due, its, importance, featured, handful, credit, artem, smotrakov, sap, convert, provided, allow, local, internal, network, resources, 12415, preferable, few, ago, but, review, decided, raise, awareness, below, underlying, parser, created, susceptible, attacks, 23926, control, logging, strongly, currently, including, pmc, evaluated, reported, december, 44228, 45046, 45105, jars, shortcoming, exchange, server, parse, untrusted, supply, then, 26336, direct, queries, main, 3143, problematic, dependency, thus, lead, context, meantime, released, avoids, testing, potential, serious, leads, nullpointerexceptions, exact, where, again, 2024, 69620, multiple, compressed, reading, data, because, one, selected, over, another, differently, affects, starting, performs, check, throws, names, later, refer, recommendations, how, libraries, securely, april, improper, validation, still, will, checkout, fresh, copy, migrate, pending, hopefully, smooth, transition, anybody, already, therefore, now, officially, previous, https, com, after, served, many, enable, workflows, features, offered, platforms, hosting, july, downloads, full, change, log, were, updated, pick, improvements, news, privacy, thanks, sponsorship, license, wide, legal, commercial, related, case, studies, secure, encryption, javadocs, changelog, versioning, overview, getting, involved,

Text of the page (random words):
apache poi the java api for microsoft documents apache software foundation apache poi home help component apis getting involved overview home download versioning changelog javadocs text extraction encryption support secure processing case studies related projects commercial support legal apache wide apache software foundation license sponsorship thanks security privacy apache poi the java api for microsoft documents project news 30 november 2025 poi 5 5 1 available the apache poi team is pleased to announce the release of 5 5 1 several dependencies were updated to their latest versions to pick up security fixes and other improvements a summary of changes is available in the release notes a full list of changes is available in the change log people interested should also follow the dev list to track progress see the downloads page for more details poi requires java 8 or newer since version 4 0 1 7 july 2025 source repository switched from subversion to git apache poi switched hosting of the source repository from subversion to git after subversion served the project well for many years it was time to enable more up to date workflows by using more of the features offered by git based platforms like github therefore the source code is now officially available at the previous read only mirror at https github com apache poi this hopefully allows a smooth transition for anybody already using git via the read only mirror users who still used the subversion based repository will need to checkout a fresh copy and migrate any pending changes 8 april 2025 cve 2025 31672 improper input validation vulnerability in apache poi before 5 4 0 while parsing of ooxml format files like xlsx docx and pptx a specially crafted file could be used to provide multiple entries with the same name in the zip compressed file format products reading the affected file could read different data because one of the zip entries with the duplicate name is selected over another by different products differently this issue affects apache poi component poi ooxml before 5 4 0 starting with 5 4 0 poi ooxml performs a check that throws an exception if zip entries with duplicate file names are found in the input file users are recommended to upgrade to version poi ooxml 5 4 0 or later which fixes the issue please refer to our security guidelines for recommendations about how to use the poi libraries securely references bug 69620 cve 2025 31672 11 november 2024 avoid log4j api 2 24 1 while testing a potential apache poi 5 4 0 release we discovered a serious bug in log4j api 2 24 1 this leads to nullpointerexceptions when you use a version of log4j core that is not of the exact same version 2 24 1 we recommend that users avoid log4j 2 24 1 and use the latest 2 24 x version where this issue is fixed again xmlbeans release 5 2 2 had the problematic log4j api 2 24 1 dependency and thus can lead to such issues if used in some other context in the meantime a version 5 3 0 of xmlbeans was released which avoids this issue please direct any queries to the log4j team the main issue is issue 3143 4 march 2022 cve 2022 26336 a carefully crafted tnef file can cause an out of memory exception in apache poi poi scratchpad versions prior to 5 2 0 description a shortcoming in the hmef package of poi scratchpad apache poi allows an attacker to cause an out of memory exception this package is used to read tnef files microsoft outlook and microsoft exchange server if an application uses poi scratchpad to parse tnef files and the application allows untrusted users to supply them then a carefully crafted file can cause an out of memory exception mitigation affected users are advised to update to poi scratchpad 5 2 1 or above which fixes this vulnerability it is recommended that you use the same versions of all poi jars 10 16 18 december 2021 log4j vulnerabilities cve 2021 44228 cve 2021 45046 and cve 2021 45105 the apache poi pmc has evaluated the security vulnerabilities reported for apache log4j poi 5 1 0 and xmlbeans 5 0 2 only have dependencies on log4j api 2 14 1 the security vulnerabilities are not in log4j api they are in log4j core if any poi or xmlbeans user uses log4j core to control their logging of their application we strongly recommend that they upgrade all their log4j dependencies to the latest version currently v2 20 0 including log4j api 13 january 2021 cve 2021 23926 xml external entity xxe processing in apache xmlbeans versions prior to 3 0 0 description when parsing xml files using xmlbeans 2 6 0 or below the underlying parser created by xmlbeans could be susceptible to xml external entity xxe attacks this issue was fixed a few years ago but on review we decided we should have a cve to raise awareness of the issue mitigation affected users are advised to update to apache xmlbeans 3 0 0 or above which fixes this vulnerability xmlbeans 4 0 0 or above is preferable references xml external entity attack 20 october 2019 cve 2019 12415 xml external entity xxe processing in apache poi versions prior to 4 1 1 description when using the tool xssfexporttoxml to convert user provided microsoft excel documents a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via xml external entity xxe processing mitigation apache poi 4 1 0 and before users who do not use the tool xssfexporttoxml are not affected affected users are advised to update to apache poi 4 1 1 which fixes this vulnerability credit this issue was discovered by artem smotrakov from sap references xml external entity attack 26 march 2019 xmlbeans 3 1 0 available the apache poi team is pleased to announce the release of xmlbeans 3 1 0 featured are a handful of bug fixes the apache poi project has unretired the xmlbeans codebase and is maintaining it as a sub project due to its importance in the poi ooxml codebase a summary of changes is available in the release notes people interested should also follow the poi dev list to track progress the xmlbeans jira project has been reopened and feel free to open issues poi 4 1 0 uses xmlbeans 3 1 0 xmlbeans requires java 6 or newer since version 3 0 2 11 january 2019 initial support for jdk 11 we did some work to verify that compilation with java 11 is working and that all unit tests pass see the details in the faq entry mission statement the apache poi project s mission is to create and maintain java apis for manipulating various file formats based upon the office open xml standards ooxml and microsoft s ole 2 compound document format ole2 in short you can read and write ms excel files using java in addition you can read and write ms word and ms powerpoint files using java apache poi is your java excel solution for excel 97 2008 we have a complete api for porting other ooxml and ole2 formats and welcome others to participate ole2 files include most microsoft office files such as xls doc and ppt as well as mfc serialization api based file formats the project provides apis for the ole2 filesystem poifs and ole2 document properties hpsf office openxml format is the new standards based xml file format found in microsoft office 2007 and 2008 this includes xlsx docx and pptx the project provides a low level api to support the open packaging conventions using openxml4j for each ms office application there exists a component module that attempts to provide a common high level java api to both ole2 and ooxml document formats this is most developed for excel workbooks ss hssf xssf work is progressing for word documents wp hwpf xwpf and powerpoint presentations sl hslf xslf the project has some support for outlook hsmf microsoft opened the specifications to this format in october 2007 we would welcome contributions there are also projects for visio hdgf and xdgf tnef hmef and publisher hpbf as a general policy we collaborate as much as possible with other projects to provide this functionality examples include cocoon for which there are serializers for hssf open office org with whom we collaborate in documenting the xls format and tika lucene for which we provide format interpretors when practical we donate components directly to those projects for poi enabling them why should i use apache poi a major use of the apache poi api is for text extraction applications such as web spiders index builders and content management systems so why should you use poifs hssf or xssf you d use poifs if you had a document written in ole 2 compound document format probably written using mfc that you needed to read in java alternatively you d use poifs to write ole 2 compound document format if you needed to inter operate with software running on the windows platform we are not just bragging when we say that poifs is the most complete and correct implementation of this file format to date you d use hssf if you needed to read or write an excel file using java xls you d use xssf if you need to read or write an ooxml excel file using java xlsx the combined ss interface allows you to easily read and write all kinds of excel files xls and xlsx using java additionally there is a specialized sxssf implementation which allows to write very large excel xlsx files in a memory optimized way components the apache poi project provides several component modules some of which may not be of interest to you use the information on our components page to determine which jar files to include in your classpath contributing so you d like to contribute to the project great we need enthusiastic hard working talented folks to help us on the project no matter your background so if you re motivated ready and have the time download the source from the git repository build the code join the mailing lists and we ll be happy to help you get started on the project please read our contribution guidelines when your contribution is ready submit a patch to our bug database copyright 2001 2026 the apache software foundation apache poi poi apache the apache logo and the apache poi project logo are trademarks of the apache software foundation send feedback about the website to dev poi apache org