---
name: validate-xxe
description: Evidence bar for XML external entity injection, reflected and blind. Use when validating a finding that claims external entity resolution in an XML parser.
---

# Validate XML external entity injection

- Establish the XML parser, runtime, reachable entity mechanism, and whether results are reflected or blind. A resolver callback alone proves entity resolution, not the claimed file-read or execution impact.
- For a file-read claim, require evidence of exact target-file bytes. Assess other claimed effects on their own evidence; file read and command execution are not universal completion requirements.