XML External Entity (XXE): How a Parser Reads /etc/passwd For You
An XML parser that resolves external entities will fetch any file or URL an attacker names. Here is how XXE turns a document upload into local file disclosure and SSRF, and the parser settings that stop it cold.