July 4, 2026
XML External Entity (XXE) Injection — Arbitrary Local File Disclosure
Recently, I identified and successfully validated an **XML External Entity (XXE)** vulnerability caused by an insecure XML parser…
By Ethical Hacker
Recently, I identified and successfully validated an XML External Entity (XXE) vulnerability caused by an insecure XML parser configuration.
By injecting a malicious XML document containing an external entity, I was able to force the server to process a local file reference. The application returned the contents of the requested system file in the HTTP response, confirming Arbitrary Local File Disclosure.