XML External Entity (XXE)
XML external entity (XXE) is a vulnerability where an XML parser processes attacker-defined external entities, letting an attacker read local files, reach internal systems, or cause denial of service. It occurs when XML input from an untrusted source is parsed with external entity resolution enabled.
XML external entity (XXE) injection abuses a feature of the XML specification that lets a document define entities pointing to external resources. If a parser resolves these external entities while processing untrusted XML, an attacker can declare an entity that references a local file (file:///etc/passwd) or a network URL, causing the parser to fetch and expose that content or make requests on the server's behalf.
Beyond file disclosure, XXE can be leveraged for server-side request forgery against internal services and for denial of service (for example, the 'billion laughs' entity-expansion attack). The fix is to disable DTD processing and external entity resolution in the XML parser configuration — most modern libraries expose a flag or a secure-processing mode to do exactly this.
Tracked as CWE-611, XXE was historically its own OWASP Top 10 entry and now falls under the misconfiguration/injection landscape. Scanners flag XML parsers configured to allow DOCTYPE declarations or external entities on untrusted input.