Improper Restriction of XML External Entity Reference (CWE-611)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Updated
About CWE-611
MITRE lists these common consequences: Read Application Data, Read Files or Directories, Bypass Protection Mechanism, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), affecting confidentiality, integrity, availability.
- MITRE name
- Improper Restriction of XML External Entity Reference
- Abstraction
- Base: abstract, but detailed enough to infer detection and prevention methods
- Status
- Draft
Also Known As
- XXE
Mitigations
- Many XML parsers and validators can be configured to disable external entity expansion.
Detection
MITRE lists these detection methods: Automated Static Analysis (high).
CWE-611 in the KEV Catalog
as of 2026-11-12- 9 CISA KEV entries name Improper Restriction of XML External Entity Reference (CWE-611) in their CVE record, tied for 33rd among the 194 weaknesses named in the catalog.
- CISA added 2 CWE-611 entries to the KEV catalog in 2024, 3 in 2025, and 1 so far in 2026.
- SysAid has the most CWE-611 entries in the CISA KEV catalog (2).
Related Attack Patterns
1 CAPEC patternsCAPEC-221Data Serialization External Entities BlowupDetailed
Loading…
CWE-611 Vulnerabilities
9 CVEs| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-20320KEV Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability | Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability | Cisco | 7.5 | 0.8% | KEV | 2026-08-19 |
| CVE-2025-58360KEV GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature | GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature | geoserver | 8.2 | 61.2% | KEV | 2025-11-25 |
| CVE-2025-2776KEV SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection | SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection | SysAid | 9.3 | 65.2% | KEV | 2025-05-07 |
| CVE-2025-2775KEV SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection | SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection | SysAid | 9.3 | 43.2% | KEV | 2025-05-07 |
| CVE-2023-45727KEV North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability | North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability | North Grid Corporation | 7.5 | 4.8% | KEV | 2023-10-18 |
| CVE-2024-34102KEV XXE can expose crypt key and other secrets granting full admin access | XXE can expose crypt key and other secrets granting full admin access | Adobe | 9.8 | 99.994% | KEV | 2024-06-13 |
| CVE-2019-9670KEV Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference | Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference | - | 9.8 | 99.986% | KEV | 2019-05-29 |
| CVE-2019-13608KEV Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability | Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability | - | 7.5 | 30.0% | KEV | 2019-08-29 |
| CVE-2016-9563KEV SAP NetWeaver XML External Entity (XXE) Vulnerability | SAP NetWeaver XML External Entity (XXE) Vulnerability | - | 6.5 | 24.2% | KEV | 2016-11-23 |
Frequently Asked Questions
What is CWE-611?→
CWE-611 (Improper Restriction of XML External Entity Reference) is a MITRE CWE entry. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
How many exploited vulnerabilities are classified as CWE-611?→
This database lists 9 CVE records mapped to CWE-611 by their CVE Numbering Authority. 9 of them are in the CISA Known Exploited Vulnerabilities catalog, and CISA links 1 to known ransomware campaigns. Examples include CVE-2026-20320, CVE-2025-58360, CVE-2025-2776.
Weakness description, consequences, and mitigations from the CWE List, © The MITRE Corporation, used under the CWE Terms of Use. CWE mappings come from each CVE record's CNA. Exploited-in-the-wild data from the CISA KEV catalog (CC0). This site is not affiliated with or endorsed by MITRE or CISA. Attack patterns from CAPEC 3.9, © The MITRE Corporation, used under the CAPEC Terms of Use.