description: In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
problem types: Information Disclosure
affected:
{
product: Apache POI
vendor: n/a
versions:
status: affected, version: Apache POI up to 4.1.0
}