Apache POI is a Java library for processing office documents.

What are the risks associated with processing untrusted documents? For example, a web site that allows users to upload documents that are processed using POI.

A potential risk I'm aware of in document parsing is that a document can reference a local resource, and the parser resolves this locally on the server. I would like to know whether this is a risk with POI.

1 Answer 1


The CVE statistics on Apache POI indicate only a single known vulnerability, which is of type "denial-of-service" and is expanded upon there: namely, a specially crafted document may make POI allocate tons of memory (that is, more than it already does normally). If such a vulnerability has been reported at all, then it means that behaviour of POI on hostile documents has been investigated; if no "local file inclusion" vulnerability was reported, then chances are that there is none.

If you want to be sure, you may download the source code and look for file access primitives (references to classes from System.IO). Alternatively, you could run the parsing in a Chroot sandbox so that local files which may be read through the parser could only be those from the sandbox.

(I don't guarantee anything here. At least, though, POI being written in pure Java, it should not suffer from remote code execution vulnerabilities through buffer overflows or similar bugs that are, by definition, prevented systematically at the VM level. You still want to enforce some strict limitations on VM memory usage, though.)


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .