XML External Entity (XXE)
High · Injection
OWASP Top 10:2025 (current)
A05:2025 — Injection · A02:2025 — Security Misconfiguration
Historical Top 10:2021 (not current)
A05:2021 — kept for older reports; use 2025 above.
CWE
CWE-611
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
OWASP A05:2025 · OWASP A05:2021 · CWE-611
Definition
XML parser resolves attacker-controlled external entities.
Root cause
Unsafe XML parsing with external entities enabled.
Affected components
- Components in the “Injection” class
- Application / API handlers
- Supporting libraries
Impact
File disclosure, SSRF, DoS.
Severity
High
Safe lab reproduction
PortSwigger XXE labs
Detection methodology
Parser configs, unusual outbound fetches during XML uploads.
Evidence examples
- Lab reproduction notes: PortSwigger XXE labs
- Request/response excerpts (redacted)
- Detection signal: Parser configs, unusual outbound fetches during XML uploads
Remediation
Disable external entities / use safe parsers.
Secure coding examples
Prefer JSON; harden XML libraries (disallow DTD).
Related CYNARKS lessons & labs
Tools: burp
Primary 2025 class: A05:2025 — Injection
Practise related skills in Labs or deepen on Academy library.