XXE

securityweb dev

Stands for: XML External Entity

An attack that abuses XML external entities to read files or reach internal systems.

XML External Entity injection tricks an XML parser into resolving an external entity, letting an attacker read local files, reach internal services (SSRF), or cause denial of service. The fix is to disable DOCTYPE/external-entity processing in the parser.

Also known as: xxe

← All glossary entries