XXE (XML External Entity) exploits XML parsers that process external entity declarations to read local files or trigger network requests.
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<foo>&xxe;</foo>
Mitigation
Disable external entity processing in the parser, prefer JSON.