XML External Entity (XXE)
High · Injection · OWASP A05:2021 · CWE-611
Description
XML parser resolves attacker-controlled external entities.
Root cause
Unsafe XML parsing with external entities enabled.
Impact
File disclosure, SSRF, DoS.
Detection
Parser configs, unusual outbound fetches during XML uploads.
Mitigation
Disable external entities / use safe parsers.
Secure coding
Prefer JSON; harden XML libraries (disallow DTD).
Safe lab example
PortSwigger XXE labs
Practise related skills in Labs or deepen on Academy library.