XML External Entity (XXE) Injection

XML supports defining custom "entities" that reference external files or URLs. If a parser resolves these by default, an uploaded XML document — an invoice, an SVG, a SOAP request — can read local files or reach internal services.

DOCTYPE declarations can define an ENTITY that points at a local file path or a URL

Even file formats that don't look like "XML" often are: SVG, DOCX, XLSX, and SOAP requests are all XML under the hood

The fix isn't sanitizing the entity value — it's telling the parser never to resolve external entities at all

Most modern XML libraries disable external entity resolution by default; the vulnerability usually comes from an explicit flag left enabled for legacy compatibility

Want this flow explained in detail as it plays?

POST/api/invoices/import

Headers

Host:app.flowground.dev

Content-Type:application/xml

Body

Stuck? Try a hint

Defense in depth

Revealed once you've worked through the hint ladder above — try the attack yourself first.

Vulnerable vs. Fixed

const { DOMParser } = require("xmldom");
const doc = new DOMParser().parseFromString(req.body, "text/xml");
// external entities are resolved by default in many parser configurations