XML External Entity (XXE)

When it applies

The server parses attacker-supplied XML with external entities enabled. Any XML sink counts — SOAP, SAML, REST-with-XML, and file formats that are XML underneath (SVG, DOCX, XLSX).

Why it works

XML DTDs can declare entities that the parser resolves — including SYSTEM entities that read local files or fetch URLs. If the parser doesn't disable external entities (the insecure default in many libs), your entity is expanded server-side.