The Symfony Config component is susceptible to XML External Entity (XXE) injection. This occurs because the `XmlUtils::parse()` function enables DTD validation by setting `$dom->validateOnParse = true` before calling `loadXML()`, and only rejects documents with a doctype afterward. Consequently, libxml resolves external entities during the loading process. While `LIBXML NONET` blocks `http://` requests, it does not block `file://` requests, allowing a remote attacker to supply a crafted XML document to determine if local files exist or cause a denial of service by pointing to large or slow files. Additionally, if a network-capable stream wrapper like `s3://` is registered, a parameter entity could be used to exfiltrate local file content to an external server. Applications are affected when untrusted XML is passed directly to the `XmlUtils::parse()` function.