XML External Entity (XXE)
Definition
XXE occurs when XML processing undesirably accesses external files or resources.
An XML parser vulnerability where external entities access unwanted files, network resources, or excessive resources.
Simply explained
A crafted XML document causes the reading program to call foreign files or network addresses that it should not open.
Why it matters in practice
The term contributes to secure, maintainable, and high-performance web applications as well as resilient technical decisions.
Example from business
A import service disables DTDs and external entities and uses secure parser profiles.
Limits and pitfalls
- XSS, CSRF, and XXE are different: XXE acts server-side in the XML parser; filtering individual characters is insufficient.
Origin & history
XXE originated from powerful DTD and entity features in insecurely configured XML parsers.
Use in mid-sized companies
- Possible application: An import service disables DTDs and external entities and uses secure parser profiles.
Frequently asked questions
What does XML External Entity (XXE) mean?
An XML parser vulnerability where external entities access unwanted files, network resources, or excessive resources. What should be considered? XSS, CSRF, and XXE are different: XXE acts server-side in the XML parser; filtering individual characters is insufficient.
Sources
- XXE Prevention Cheat Sheet · OWASP, XXE Prevention Cheat Sheet
Source checked on 10.10.2026. Editorial application examples are hypothetical; no evidence of real customer results.
Editorially reviewed on: