CWE-827
Improper Control of Document Type Definition
The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
Impactr finds and proves whether CWE-827 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.