srl
XML External Entities (XXE)
An XML External Entity Injection (XXE) vulnerability occurs when an application parses attacker-supplied XML with external entity processing enabled. The parser resolves an attacker-defined entity that references a local file, an internal URL, or a remote DTD — turning the XML input into a file-read, SSRF, or RCE primitive.
2026 context: XXE is no longer just a “SOAP endpoint” bug. It lives in document-processing pipelines (DOCX, XLSX, SVG, PDF/XFA), SAML, XSLT transforms, and AI/LLM document loaders. The scanner-bypass research of 2025–2026 shows that even applications that do implement a DOCTYPE filter can be bypassed through encoding tricks (PhpSpreadsheet’s XmlScanner) and parser-differential behaviour.