Common Weakness Enumeration

    CWE Definition / CWE-827

    CWE-827: Improper Control of Document Type Definition

    The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.

    Published:25 Oct 2010
    Organization:MITRE
    Modified:11 Dec 2025

    Related Weakness

    CWE-706: Use of Incorrectly-Resolved Name or Reference

    CWE-829: Inclusion of Functionality from Untrusted Control Sphere

    CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

    CWE-827: Improper Control of Document Type Definition | CVE-DB