Skip to content
Log inStart free trial

CWE-611: Improper Restriction of XML External Entity Reference

Base

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Consequences

  • Confidentiality: Read Application Data, Read Files or Directories
  • Integrity: Bypass Protection Mechanism
  • Availability: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)

How to prevent it

  • Implementation, System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.

Recent advisories

  • GHSA-3x94-m842-937c — PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
  • GHSA-rxj4-h86g-25gc — PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
  • GHSA-8678-w3jw-xfc2 — Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
  • GHSA-x4r9-gmw3-hxww — GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
  • GHSA-x6g4-fwcc-jj8w — Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
  • GHSA-5wm8-gmm8-39j9 — fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes
  • GHSA-pj6p-9p8x-5mfc — Alkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host
  • GHSA-rcc6-6q2f-m2cw — Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information
  • GHSA-3446-6mgw-f79p — Grav is Vulnerable to XXE via SVG Upload
  • GHSA-w3x6-4m5h-cxqf — Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability
  • EEF-CVE-2026-28809 — XXE in esaml SAML library allows local file read and potential SSRF
  • GHSA-qcfc-hmrc-59x7 — Apache Struts 2 is Missing XML Validation
  • GHSA-fjf5-xgmq-5525 — GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
  • GHSA-jj54-8f66-c5pc — [XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
  • GHSA-mc43-4fqr-c965 — GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

All advisories for CWE-611

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor