just backported the XXE on by default to some older releases https://dev.lucee.org/t/lucee-5-4-2-and-6-0-now-has-anti-xxe-configuration-enabled-by-default/12811/6