XML External Entity (XXE) Injection

Apache Cocoon is vulnerable to XML External Entity (XXE) Injection. The vulnerability is due to improper XML parsing configuration in the StreamGenerator class, which allows an attacker to submit a malicious XML document, resulting in XXE. An attacker can exploit this flaw to read arbitrary files on the file system, or cause Denial of Service.