Guide to XML entities with examples
Summary: PortSwigger's guide explains that XML entities represent data within a document, with built-in entities like < and > standing in for the metacharacters < and >, and custom entities defined in the document type definition (DTD). External entities, declared with the SYSTEM keyword and a URL, can be loaded using the file:// protocol, which the guide identifies as the primary means by which XML external entity attacks arise.
Why it matters: An external entity declaration only needs a URL, and the file:// protocol lets it pull content from the local filesystem - which is the mechanism behind XXE attacks.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026