Blind XXE is a type of XML External Entity injection where the application processes a malicious entity, but the attacker does not get the file contents or parser output directly in the response. The parser still resolves external references, which can expose local files, internal network resources, or system metadata through side effects rather than visible output.
This matters because the absence of an obvious response can hide the attack. Defenders may miss it if they only look for reflected data in the page body. In real attacks, blind XXE is often used with out-of-band channels such as DNS or HTTP callbacks to confirm that entity resolution happened and to leak small pieces of information. The main defenses are to disable external entities, block DTD processing where it is not needed, and use hardened XML parser settings in every service that accepts untrusted XML.