The impact varies with the platform and parser being used, and with the extensions installed. I don't know the specifics of ExpatParser (the one used by Django)

The impact varies with the platform and parser being used, and with the extensions installed. I don't know the specifics of ExpatParser (the one used by Django), but in general, the "careless" parsing of unsanitized user-supplied XML might lead to: - DoS - Disclosing of sensitive files (in general, the XML has to "validate". In PHP, it's always possible to read any file accessible by the process parsing the XML). - Making arbitrary network connections (with this an attacker can portscan a network, attack vulnerable services that would be protected by firewall, and/or use the vulnerable server as a restricted kind of proxy). - Probing LDAP directories. - Remote code execution. See, for instance: http://media.blackhat.com/bh-us-12/Briefings/Polyakov/BH_US_12_Polyakov_SSRF_Business_Slides.pdf http://media.blackhat.com/bh-us-12/Briefings/Polyakov/BH_US_... http://defcon.org.ua/data/2/2_Vorontsov_XXE.pdf http://defcon.org.ua/data/2/2_Vorontsov_XXE.pdf http://www.insinuator.net/2013/01/rails-yaml/ http://www.insinuator.net/2013/01/rails-yaml/ Edit: As a clarification, I'm not implying that any of the above (apart from the DoS issue) is applicable to Django. I'm just saying what can possibly happen (and often happens for PHP apps).