An XmlTextReader is created from a variable source without disabling DTD processing, allowing external entity resolution.
Use XmlReader.Create with XmlReaderSettings that set DtdProcessing to Prohibit and XmlResolver to null.