XXE Disable Entity Loader False
libxml_disable_entity_loader(false) re-enables external entity loading, exposing the parser to XML External Entity (XXE) attacks (CWE-611) that can read local files or trigger SSRF.
Standards mapping
- OWASP Top 10
- A05:2021 - Security Misconfiguration
- OWASP ASVS
- V5.5.2 (L1)
Vulnerable vs. safe
libxml_disable_entity_loader(false);libxml_disable_entity_loader(true);Why it matters & how to fix it
libxml_disable_entity_loader(false) re-enables external entity loading, exposing the parser to XML External Entity (XXE) attacks (CWE-611) that can read local files or trigger SSRF. Remove this call; on modern libxml (>=2.9) external entities are disabled by default. When parsing untrusted XML, avoid the LIBXML_NOENT and LIBXML_DTDLOAD flags.
References
Rule ID integsec-php-xxe-disable-entity-loader-false - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Other Security ChecksChild Process Shell True
- JavaScript / TypeScript - Other Security ChecksOpen Redirect Tainted Input
- Python - Other Security ChecksDjango Mark Safe
- Python - Other Security ChecksFlask Debug Enabled
- Python - Other Security ChecksFlask Render Template String
- Python - Other Security ChecksInsecure Tempfile Mktemp