XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1 2.0.x before 2.0.13rc1 2.2.x before 2.2.5rc1 and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.