XXE (XML External Entity) injection occurs when an application parses XML from an untrusted source with a parser that supports external entities. A crafted document can make the parser read local files, contact internal addresses or consume excessive resources.
Why it matters
XML appears in many places beyond obvious APIs: SOAP services, document formats, SVG images, single sign-on messages and configuration uploads. A developer may not realise a library is parsing XML at all. XXE can lead to data exposure and can combine with SSRF to reach internal systems, and it was a named category in earlier editions of the OWASP Top 10.
Example
The usual defence is configuration, not filtering. In Python's defusedxml or in Java parsers, disable document type definitions and external entities:
factory.setFeature(
"http://apache.org/xml/features/disallow-doctype-decl", true);Newer library versions often disable the dangerous features by default, but explicit settings and tests are safer.
Common mistakes
- Relying on the parser defaults without checking them.
- Trying to filter malicious strings from the XML instead of turning off the feature.
- Forgetting indirect parsers, such as image or office file libraries.
- Leaving old library versions in place.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.