XML supports a facility known as "external entities", which instruct an XML processor to retrieve and perform an inline include of XML located at a particular URI. An external XML entity can be used to append or modify the document type declaration (DTD) associated with an XML document. An external XML entity can also be used to include XML within the content of an XML document.
Now assume that the XML processor parses data originating from a source under attacker control. Most of the time the processor will not be validating, but it MAY include the replacement text thus initiating an unexpected file open operation, or HTTP transfer, or whatever system ids the XML processor knows how to access.
below is a sample XML document that will use this functionality to include the contents of a local file (/etc/passwd)
If possible it's recommended to disable parsing of XML external entities.
CWE-611: Information Exposure Through XML External Entity Reference
XXE (Xml eXternal Entity) attack
WordPress Plugin Slideshow Multiple Cross-Site Scripting and Information Disclosure Vulnerabilities (2.1.12)
Node.js Web Application does not handle unhandledRejection
WordPress Plugin WooCommerce Information Disclosure (4.5.2)
XML external entity injection via File Upload