XXE

What it means

XXE stands for XML external entity. An XML document can carry references telling the parser to go and fetch something else. A parser configured to follow them does so without asking. Those references are entities, and the external kind points at something outside the document.

An attacker points one of those references at a file on your server, or at an internal address, and the parser hands the contents back.

Why it matters

It amounts to reading your server's own filesystem from outside: configuration files, credentials, keys. It doubles as a way to make your server call internal services, which is server-side request forgery wearing a different hat.

Because it arrives inside a file upload or an API payload, it often reaches parts of the system nobody expected outside traffic to touch. Review misses it easily, because the vulnerable code reads like two ordinary lines. Read this document. Parse it.

How much it costs you depends on what the server process can read, which is routinely more than the application itself needs.

How it shows up

Look wherever you accept XML: document uploads, older API endpoints, spreadsheet and office file imports, single sign-on messages, anything speaking an older integration format.

The fix is usually a flag rather than a rewrite. OWASP's advice is to disable document type definitions outright where you can. Defaults vary by language and by version, so do not assume yours is safe, and check the libraries underneath your own code. A parser buried in a dependency can be configured differently from the one you call directly, and it is generally the older one.