XXE: XML external entities

January 27, 2026 · 1 min read · #web #xxe #xml

XML supports entities, placeholders expanded by the parser. External entities load content from a URI:

<?xml version="1.0"?>
<!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]>
<r>&x;</r>

If the parser resolves &x;, the contents of /etc/passwd end up in the response. With http:// it becomes SSRF; with recursive entities (billion laughs) it becomes DoS.

Defence

Disable DTD and external-entity resolution in the parser. In most languages it is a single option (e.g. libxml_disable_entity_loader in old PHP, or configuring the Java factory with disallow-doctype-decl). Prefer JSON when XML is not needed.

« back to home