{"id":"CVE-2019-12415","aliases":["DEBIAN-CVE-2019-12415","EUVD-2022-3406","GHSA-9jwc-q6j3-8g9g","UBUNTU-CVE-2019-12415"],"status":"published","title":"Improper Restriction of XML External Entity Reference in Apache POI","description":"In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00998,"percentile":0.6298,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2019-10-23T19:27:20Z","modified":"2026-10-24T10:30:57Z","fixes":[{"ecosystem":"Maven","package":"org.apache.poi:poi","fixed_in":["4.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"libapache-poi-java","fixed_in":["4.1.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.poi:poi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.0"},{"fixed":"4.1.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libapache-poi-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.1-4","4.0.1-5","4.0.1-6","4.1.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libapache-poi-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.1-6","4.1.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libapache-poi-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}],"versions":["4.0.1-6"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.poi:poi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1"}]}],"versions":["3.0-FINAL","3.0.1-FINAL","3.0.2-FINAL","3.0.2-beta1","3.0.2-beta2","3.1-FINAL","3.1-beta1","3.1-beta2","3.10-FINAL","3.10-beta1","3.10-beta2","3.10.1","3.11","3.11-beta1","3.11-beta2","3.11-beta3","3.12","3.12-beta1","3.13","3.13-beta1","3.14","3.14-beta1","3.15","3.15-beta1","3.15-beta2","3.16","3.16-beta1","3.16-beta2","3.17","3.17-beta1","3.2-FINAL","3.5-FINAL","3.5-beta1","3.5-beta3","3.5-beta4","3.5-beta5","3.5-beta6","3.6","3.7","3.7-beta1","3.7-beta2","3.7-beta3","3.8","3.8-beta1","3.8-beta2","3.8-beta3","3.8-beta4","3.8-beta5","3.9","4.0.0","4.0.1","4.1.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache-poi-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache-poi-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.1-3","4.0.1-1~18.03"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache-poi-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libapache-poi-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.1-1","4.0.1-2","4.0.1-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libapache-poi-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.1-4","4.0.1-5","4.0.1-6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libapache-poi-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.1-6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libapache-poi-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.1-6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libapache-poi-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.1-6"]}],"products":[{"vendor":"apache","product":"poi"},{"vendor":"apache software foundation","product":"apache poi"},{"vendor":"oracle","product":"application_testing_suite"},{"vendor":"oracle","product":"banking_enterprise_originations"},{"vendor":"oracle","product":"banking_enterprise_product_manufacturing"},{"vendor":"oracle","product":"banking_payments"},{"vendor":"oracle","product":"banking_platform"},{"vendor":"oracle","product":"big_data_discovery"},{"vendor":"oracle","product":"communications_diameter_signaling_router_idih\\"},{"vendor":"oracle","product":"endeca_information_discovery_studio"},{"vendor":"oracle","product":"enterprise_manager_base_platform"},{"vendor":"oracle","product":"enterprise_repository"},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure"},{"vendor":"oracle","product":"financial_services_market_risk_measurement_and_management"},{"vendor":"oracle","product":"flexcube_private_banking"},{"vendor":"oracle","product":"hyperion_infrastructure_technology"},{"vendor":"oracle","product":"instantis_enterprisetrack"},{"vendor":"oracle","product":"insurance_policy_administration_j2ee"},{"vendor":"oracle","product":"insurance_rules_palette"},{"vendor":"oracle","product":"jdeveloper"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"oracle","product":"primavera_gateway"},{"vendor":"oracle","product":"primavera_unifier"},{"vendor":"oracle","product":"retail_clearance_optimization_engine"},{"vendor":"oracle","product":"retail_order_broker"},{"vendor":"oracle","product":"retail_predictive_application_server"},{"vendor":"oracle","product":"webcenter_portal"},{"vendor":"oracle","product":"webcenter_sites"}],"references":[{"url":"https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c%40%3Cuser.tika.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007%40%3Cuser.tika.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c%40%3Cuser.tika.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e%40%3Cannounce.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12415","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e@%3Cannounce.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c@%3Cuser.tika.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007@%3Cuser.tika.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c@%3Cuser.tika.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9jwc-q6j3-8g9g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12415","tags":["advisory"]},{"url":"https://github.com/apache/poi","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2019-12415","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/10/23/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12415","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-12415","description":"In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.","status":"published","published":"2019-10-23T19:27:20Z","modified":"2024-08-04T23:17:40.071Z","updated_at":"2026-11-02T14:20:23.697579Z"}],"euvd":[{"id":"EUVD-2022-3406","description":"In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.","status":"published","published":"2019-10-23T19:27:20Z","modified":"2024-08-04T23:17:40Z","updated_at":"2026-11-03T02:40:45.973526Z"}],"ghsa":[{"id":"GHSA-9jwc-q6j3-8g9g","title":"Improper Restriction of XML External Entity Reference in Apache POI ","description":"In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.","status":"published","published":"2022-05-24T16:59:46Z","modified":"2023-01-28T05:02:35Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:36:23.433782Z"}],"nvd":[{"id":"CVE-2019-12415","description":"In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.","status":"published","published":"2019-10-23T20:15:12.707Z","modified":"2026-06-17T02:14:36.483Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:05:32.982925Z"}],"osv":[{"id":"CVE-2019-12415","description":"In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.","status":"published","published":"2019-10-23T20:15:12.707Z","modified":"2026-10-24T10:30:57.808500234Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-12415","description":"In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.","status":"published","published":"2019-10-23T20:15:12.707Z","modified":"2026-09-26T04:00:04.58091405Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-9jwc-q6j3-8g9g","title":"Improper Restriction of XML External Entity Reference in Apache POI ","description":"In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.","status":"published","published":"2022-05-24T16:59:46Z","modified":"2023-11-08T04:01:04.785042Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"UBUNTU-CVE-2019-12415","description":"In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.","status":"published","published":"2019-10-23T20:15:00Z","modified":"2026-10-17T12:55:33.023144722Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.202697Z"}]}}