XML External Entity (XXE) Injection

What Is Broken and Why

XXE vulnerabilities arise when XML input containing a DOCTYPE declaration with external entity references is processed by a parser that has external entity resolution enabled. The parser fetches the referenced resource (a local file, remote URL, or network service) and substitutes it into the document, which the application may then reflect in a response or process further. Beyond data disclosure, XXE enables SSRF and, via parameter entities, blind out-of-band exfiltration. The root cause is misconfigured or default-insecure XML parser settings.

Key Signals

• Application accepts XML input (SOAP endpoints, REST APIs with Content-Type: application/xml, file uploads of .xml/.docx/.xlsx/.svg)
• Requests containing <?xml declarations
• Error messages referencing XML parsing libraries or DTD processing
• Java APIs in stack traces: DocumentBuilder, SAXParser, XMLInputFactory, TransformerFactory
• Application processing SVG, RSS/Atom feeds, or office document formats (DOCX, XLSX use XML internally)
• Response includes content from server filesystem or internal network resources