In Apache POI up to 4.1.0, when converting user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
Created apache-poi tracking bugs for this issue:
Affects: fedora-all [bug 1802532]
The vulnerability is in the XSSFExportToXml util; avoid usage of this tool to mitigate the vulnerability.
This issue has been addressed in the following products:
Red Hat Fuse 7.10
Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):