XXE injection - Port Swigger
Summary: XML external entity injection, or XXE, is a web security vulnerability that lets an attacker interfere with how an application processes XML data. PortSwigger states it often allows an attacker to view files on the application server's filesystem and to interact with any back-end or external systems the application itself can access.
Why it matters: An XXE flaw hands an attacker the application's own access: the server's filesystem and every back-end or external system the application can reach, not just the one endpoint that parses XML.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026