CWE-827: Improper Control of Document Type Definition
The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files... 3.3 Low
- eclipse foundation rdf4j In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE)... 8.7 High
- eclipse jgit XXE vulnerability in Eclipse JGit 6.8 Medium
- msg suisse ag easytax XML External Entity (XXE) Vulnerability in EasyTax 4.6 Medium