XPath Injection.

An injection flaw in which untrusted input alters an XPath query against an XML document, allowing data exfiltration or authentication bypass. It belongs to the Attacks & Threats category of cybersecurity.

An injection flaw in which untrusted input alters an XPath query against an XML document, allowing data exfiltration or authentication bypass.

XPath injection occurs when an application builds XPath queries against an XML document by string-concatenating user input, similarly to classic SQL injection. An attacker can break out of the intended expression with quotes, boolean tautologies like ' or '1'='1, or comments to extract arbitrary nodes, bypass login forms backed by XML user stores, or perform blind exfiltration through boolean and timing oracles. The flaw is most common in legacy SOAP services, configuration backends, and applications that store credentials in XML files. Defenses include parameterized XPath APIs (where available), strict input validation against an allow-list, and migrating sensitive lookups to safer data stores.

Defences for XPath Injection typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: XPath query injection.