{
  "slug": "xml-external-entity-injection",
  "url": "https://library.infinity8labs.com/xml-external-entity-injection/",
  "title": "XML external entity injection (XXE)",
  "short": "XXE",
  "aliases": [
    "XML external entity attack",
    "External entity injection",
    "Blind XXE"
  ],
  "summary": "XXE occurs when an XML parser processes attacker-controlled external entities or document type definitions. It can expose local files, trigger server-side requests, or exhaust application resources.",
  "cwe": [
    "CWE-611",
    "CWE-776"
  ],
  "owasp": "A05:2021 Security Misconfiguration",
  "typical_severity": {
    "min": "medium",
    "max": "critical"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-611: Improper Restriction of XML External Entity Reference",
      "url": "https://cwe.mitre.org/data/definitions/611.html"
    },
    {
      "title": "CWE-776: Improper Restriction of Recursive Entity References in DTDs",
      "url": "https://cwe.mitre.org/data/definitions/776.html"
    },
    {
      "title": "OWASP XML External Entity Prevention Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Top 10 A05:2021 Security Misconfiguration",
      "url": "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/"
    },
    {
      "title": "PortSwigger Web Security Academy: XML external entity injection",
      "url": "https://portswigger.net/web-security/xxe"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/xml-external-entity-injection/#overview",
    "https://library.infinity8labs.com/xml-external-entity-injection/#impact",
    "https://library.infinity8labs.com/xml-external-entity-injection/#examples",
    "https://library.infinity8labs.com/xml-external-entity-injection/#remediation",
    "https://library.infinity8labs.com/xml-external-entity-injection/#testing",
    "https://library.infinity8labs.com/xml-external-entity-injection/#references"
  ]
}