CWE-611 is the weakness category for improper restriction of XML external entity (XXE) references. It applies when an XML parser is allowed to resolve external entities from files, URLs, or other internal resources instead of treating them as untrusted input. In a vulnerable application, an attacker can abuse crafted XML to read local files, trigger server-side requests, or leak data through error messages and blind callbacks.
This matters because XML is still common in administration, provisioning, and integration workflows, where a permissive parser can turn a routine input path into a security boundary failure. Defenders reduce risk by disabling external entity resolution, blocking DTD processing when it is not needed, using hardened parser defaults, and validating that XML inputs cannot reach sensitive back-end resources. CWE-611 is the standard label used to describe and track these XXE-related flaws across products and advisories.