The product processes XML that can contain external entities whose URIs resolve to documents outside the intended sphere of control, causing unintended documents to be embedded in the product's output.
CyStack analysis based on the official MITRE CWE source 4.20 (04/30/2026).
XML DTDs allow entities to be defined with a URI as their substitution source. During processing, an XML parser can access that URI, read its contents, and insert them back into the document for further processing. If an attacker can control the DTD or entity and the default resolver permits external access, the application may read local files, make network requests on the server's behalf, or process excessive data or nested references, depending on how the result and resources are handled.
An XML document may contain a DTD that defines entities using a URI as the replacement source. The parser can retrieve that URI and feed its contents back into the document; when the default entity resolver remains enabled, data or resources outside the intended boundary may be accessed and incorporated into processing. The weakness arises during implementation and is not language-specific or technology-specific, although it applies to XML-based and web-based systems.
Potential consequences include confidentiality, integrity, and availability impacts:
During implementation and system configuration, configure the XML parser or validator to disable external entity expansion. Apply this setting consistently to every parser and validation component that processes untrusted XML.
Automated static analysis, commonly called Static Application Security Testing (SAST), can identify some instances by analyzing source or compiled code without executing it. It typically models data flow and control flow, then searches for potentially vulnerable patterns connecting input sources to sinks where data interacts with external components or lower layers; the recorded effectiveness is high, although this approach covers only some instances.
The following are representative examples, not an exhaustive list:
CVE-2022-42745: Recruiter software allowed arbitrary file reading through XXE.CVE-2005-1306: A browser control allowed remote attackers to determine whether files existed through JavaScript containing XML.CVE-2012-5656: XXE occurred during SVG image conversion.CVE-2012-2239: XXE in a PHP application allowed reading the application's configuration file.CVE-2012-3489: XXE occurred in a database server.CVE-2012-4399: XXE in a rapid web application development framework allowed arbitrary file reading.CVE-2012-3363: XXE was possible through an XML-RPC request.CVE-2012-0037: XXE occurred in an office document product using RDF.CVE-2011-4107: XXE occurred in a web-based database administration tool.CVE-2010-3322: XXE occurred in a product for large-scale data analysis.CVE-2009-1699: XXE occurred in XSL stylesheet functionality in a common library used by some web browsers.Original source fields and evidence from the MITRE CWE record.
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. The XML parser can access the contents of this URI and embed these contents back into the XML document for further processing.
Confidentiality
Read Application Data, Read Files or Directories
If the attacker is able to include a crafted DTD and a default entity resolver is enabled, the attacker may be able to access arbitrary files on the system. By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. For example, a URI such as "file:///c:/winnt/win.ini" designates (in Windows) the file C:\Winnt\win.ini, or file:///etc/passwd designates the password file in Unix-based systems. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g., in an error message), thereby exposing the file contents.
Integrity
Bypass Protection Mechanism
An attacker may supply a crafted DTD using URIs with schemes such as http://, forcing the application to make outgoing HTTP requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions; hide the source of attacks such as port scanning; or otherwise leverage the server's trust relationship with other entities.
Availability
DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
The product could consume excessive CPU cycles or memory using a URI that points to a large file, or a device that always returns data such as /dev/random. Alternately, the URI could reference a file that contains many nested or recursive entity references to further slow down parsing.
These examples illustrate this CWE entry and are not an exhaustive list of related vulnerabilities.
CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
en