XML external entity injection (XXE)
XML external entity injection is a vulnerability in which an application parses attacker supplied XML with a parser that resolves external entities. The declaration inside the document tells the parser to fetch a local file or a URL, and the parser obeys, turning a document upload into file disclosure or a request from the server.
The mechanism sits in the document type declaration. An entity defined with the SYSTEM keyword names a resource, the parser resolves it while building the document, and the resolved content is placed wherever the entity is referenced. If the application then reflects any part of the parsed document, the file comes back in the response. If it reflects nothing, the same primitive still works out of band: a parameter entity that loads an external declaration from a host the attacker controls turns the resolution itself into the channel.
Two consequences matter more than file reading. The parser will fetch URLs, which makes this a clean route to server side request forgery from inside the network. And recursive entity definitions exhaust memory, which is a denial of service that needs one small file.
Where we still find it is not in modern JSON APIs but around them: SOAP services kept alive for one partner, document converters, SAML endpoints, and file formats that are XML underneath such as spreadsheets and vector images. The fix is to disable document type declarations and external entity resolution in the parser rather than to filter payloads, and it is part of the API testing work where legacy XML endpoints get this treatment.