XML External Entity (XXE) Injection

XML External Entity injection exploits a feature built into the XML specification itself: the ability for a document to define entities that reference external content, including local files and internal network resources.

How the underlying feature is supposed to work

XML's DOCTYPE declaration allows a document to define custom entities, essentially named placeholders. The specification allows these entities to reference external resources, originally intended for legitimate uses like pulling in shared content across multiple documents. Most applications parsing XML have no actual use for this feature, but many XML parsers enable it by default regardless.

What an attacker can do with it

• Local file disclosure. Defining an entity that references a file on the server's own filesystem, then having the parsed document reflect that file's contents back.
• Server-Side Request Forgery. Defining an entity that references an internal network address, turning XXE into a delivery mechanism for the same internal-network access problem covered in our SSRF explainer.
• Denial of service. A crafted entity that expands recursively, sometimes called a billion laughs attack, can exhaust server memory processing a tiny input document.

Why it still shows up

XXE became far less common once major XML libraries began disabling external entities by default in newer versions. It still appears reliably in legacy codebases running older library versions, custom XML parsing logic that bypassed the safer defaults, and file upload features that accept XML-based formats, like certain office document formats or SVG images, without realizing those formats are XML underneath.

Where to look for it

Any feature that accepts XML input directly, or accepts a file format that is secretly XML-based, deserves a specific check for external entity handling, even if the feature's obvious purpose has nothing to do with XML parsing on the surface.