An XML External Entity Injection (XXE) vulnerability was discovered in oXygen XML Editor 21.1.1. The vulnerability allows an attacker to read arbitrary files on the vulnerable system. The vulnerability is triggered when a user opens a malicious XML file. The malicious XML file contains an XML External Entity (XXE) declaration which references a malicious DTD file hosted on a remote server. The malicious DTD file contains an entity declaration which references a file on the vulnerable system. When the malicious XML file is opened, the vulnerable application attempts to parse the malicious DTD file, which in turn causes the vulnerable application to attempt to read the file referenced in the entity declaration. This allows an attacker to read arbitrary files on the vulnerable system.