Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Apache POI unoconv Package Allows Unauthorized File Access

CVE-2019-17400 · published 7 years ago
Summary

The Apache POI unoconv package contains a security flaw that could allow an attacker to access files on your server or read local files on your network. This could happen if you use the package to convert files from one format to another. To protect your system, update the unoconv package to version 0.9 or later.

What to do
  • Update dag wieers unoconv to version 0.9.0.
  • Update universal_office_converter_project universal_office_converter to version 0.9 or later.
Affected software
Ecosystem VendorProductAffected versions
pip dag wieers unoconv < 0.9.0
Fix: upgrade to 0.9.0
– universal_office_converter_project universal_office_converter < 0.9
cpe:2.3:a:universal_office_converter_project:universal_office_converter:*:*:*:*:*:*:*:*
Original advisory text
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.7 High
Exploitation
2% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published21 Oct 2019
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-27p5-7cw6-m45h · GHSA
CVE-2019-17400 · NVD
Track software like this
Free during beta