In JetBrains TeamCity prior to 2021.2.1, XXE during the parsing of the configuration file was possible.
jetbrains teamcity