XML External Entity (XXE) Processing

camunda-xml-model is vulnerable to XML external entity XXE processing attacks. The library does not set the expandEntityReferences property of the DocumentBuilderFactory to false by default. This can allow an attacker to gain access to the system's filesystem or execute HTTP and FTP requests...