DocumentBuilderFactory created without disabling external entities is vulnerable to XXE.
Call setFeature to disable doctype declarations and external general and parameter entities.