XPath Injection
XPath injection is a vulnerability where an attacker inserts crafted input into an XPath query used to navigate XML data, altering the query to bypass authentication or extract unauthorized nodes. It occurs when untrusted input is concatenated into an XPath expression without proper handling.
XPath injection targets applications that query XML documents using XPath expressions built from untrusted input. Like SQL injection, an attacker supplies characters that change the query's structure — for instance injecting ' or '1'='1 into a login lookup so the expression always evaluates true, bypassing authentication, or crafting predicates that walk the document to extract nodes they shouldn't see.
Because standard XPath (1.0) has no access controls and often exposes the whole document, a single injectable query can leak the entire XML store, including credentials held in the file. The defense is to keep user input out of the query structure: use parameterized XPath (variable binding) where the engine supports it, or strictly escape and validate input against an allowlist before building the expression.
Tracked as CWE-643 and part of the OWASP injection category, XPath injection is less common than SQLi only because fewer apps store data in XML, but the mechanics and severity are directly analogous. Scanners flag XPath expressions assembled from tainted input.