--- title: The File That Answered Back — XXE Hidden in Cell A2 description: A bug bounty writeup detailing the discovery of an XXE (XML External Entity) vulnerability hidden inside an XLSX file upload endpoint. The author explains how... canonical: https://daily.dev/posts/the-file-that-answered-back-xxe-hidden-in-cell-a2-oaawmqaad twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The File That Answered Back — XXE Hidden in Cell A2 | daily.dev og:description: A bug bounty writeup detailing the discovery of an XXE (XML External Entity) vulnerability hidden inside an XLSX file upload endpoint. The author explains how... og:url: https://daily.dev/posts/the-file-that-answered-back-xxe-hidden-in-cell-a2-oaawmqaad og:image: https://api.daily.dev/og/posts/oAAWMQaaD.png og:image:alt: The File That Answered Back — XXE Hidden in Cell A2 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The File That Answered Back — XXE Hidden in Cell A2 **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 12 min read · 0 upvotes · 0 comments ## Summary A bug bounty writeup detailing the discovery of an XXE (XML External Entity) vulnerability hidden inside an XLSX file upload endpoint. The author explains how .xlsx files are actually ZIP archives containing XML, and how a server-side Excel parser with external entity resolution enabled by default allowed unauthenticated arbitrary file reads. The post covers WAF bypass context (Imperva blocking DOCTYPE keyword), payload construction from scratch (all five required OOXML files), and three confirmed file reads from a Windows server. The fix involves setting DtdProcessing.Prohibit and XmlResolver=null in .NET, or switching to a hardened library like EPPlus or ClosedXML. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [“Anonymous” \(Miscellaneous\) Writeup](https://daily.dev/posts/anonymous-miscellaneous-writeup-qg1gjwsgu) · InfoSec Write-ups · 1 upvotes · 0 comments - [Phishing campaign chains old Office flaw with fileless XWorm RAT to evade detection](https://daily.dev/posts/phishing-campaign-chains-old-office-flaw-with-fileless-xworm-rat-to-evade-detection-pwlcvtqcz) · CSO Online · 0 upvotes · 0 comments - [Ancient Excel bug comes out of retirement for active attacks](https://daily.dev/posts/ancient-excel-bug-comes-out-of-retirement-for-active-attacks-rfkobowbl) · The Register · 0 upvotes · 0 comments - [XWorm campaign shows a shift toward fileless malware and in-memory evasion tactics](https://daily.dev/posts/xworm-campaign-shows-a-shift-toward-fileless-malware-and-in-memory-evasion-tactics-4hti00qsj) · CSO Online · 1 upvotes · 0 comments --- Tags: [#.net](https://daily.dev/tags/.net) [View this post on daily.dev](https://daily.dev/posts/the-file-that-answered-back-xxe-hidden-in-cell-a2-oaawmqaad) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The File That Answered Back — XXE Hidden in Cell A2","url":"https://daily.dev/posts/the-file-that-answered-back-xxe-hidden-in-cell-a2-oaawmqaad","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-file-that-answered-back-xxe-hidden-in-cell-a2-oaawmqaad"},"datePublished":"2026-07-06T07:28:44.097Z","dateModified":"2026-07-06T07:29:10.442Z","description":"A bug bounty writeup detailing the discovery of an XXE (XML External Entity) vulnerability hidden inside an XLSX file upload endpoint. The author explains how...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f1f869ee4d980afad07d2a40824a2490?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f1f869ee4d980afad07d2a40824a2490?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoSec Write-ups","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoSec Write-ups","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/f0dc21b5bbfd46fda36f7b4b53dd1705","url":"https://daily.dev/sources/infosecwriteups"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-file-that-answered-back-xxe-hidden-in-cell-a2-oaawmqaad","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":".net","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":3,"name":"The File That Answered Back — XXE Hidden in Cell A2"}]} ```