Last updated: May 1, 2026
XML External Entity (XXE) injection exploits XML parsers that process references to external entities. A classic vulnerability in XML-consuming applications — SOAP services, document upload features, SAML, configuration parsers. Can lead to file disclosure, SSRF, DoS, and RCE.
How XXE works
XML supports external entities — references to external resources. When a parser fetches the referenced content and substitutes it into the document, attacker-controlled references can point at sensitive local files or internal URLs.
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>Parser sees &xxe;, expands it to contents of /etc/passwd. If the parsed content is echoed back (e.g. in an API response), attacker receives the file.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.