diff --git a/egovframework.dev.imp.commngt/src/egovframework/dev/imp/commngt/util/ComResourceUtils.java b/egovframework.dev.imp.commngt/src/egovframework/dev/imp/commngt/util/ComResourceUtils.java
index 5a1a1c5e..a3ae75db 100644
--- a/egovframework.dev.imp.commngt/src/egovframework/dev/imp/commngt/util/ComResourceUtils.java
+++ b/egovframework.dev.imp.commngt/src/egovframework/dev/imp/commngt/util/ComResourceUtils.java
@@ -181,6 +181,11 @@ public static boolean checkOldWebXml(IContainer container, InputStream oriCon, I
     	try {
 
     		DocumentBuilderFactory docBF = DocumentBuilderFactory.newInstance();
+    		// XXE(XML External Entity Injection, CWE-611) 취약점 방지
+    		docBF.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+    		docBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    		docBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+    		docBF.setXIncludeAware(false);
     		DocumentBuilder docBuilder = (DocumentBuilder) docBF.newDocumentBuilder();
     		
     		// AS-IS 시스템의 document
@@ -246,6 +251,11 @@ public static InputStream modifyWebXml(IContainer container, String fname, Input
     	try {
 
     		DocumentBuilderFactory docBF = DocumentBuilderFactory.newInstance();
+    		// XXE(XML External Entity Injection, CWE-611) 취약점 방지
+    		docBF.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+    		docBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    		docBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+    		docBF.setXIncludeAware(false);
     		DocumentBuilder docBuilder = (DocumentBuilder) docBF.newDocumentBuilder();
     		
     		// AS-IS 시스템의 document
diff --git a/egovframework.mdev.imp.commngt/src/egovframework/mdev/imp/commngt/util/ComResourceUtils.java b/egovframework.mdev.imp.commngt/src/egovframework/mdev/imp/commngt/util/ComResourceUtils.java
index 470ac1d4..9f459183 100644
--- a/egovframework.mdev.imp.commngt/src/egovframework/mdev/imp/commngt/util/ComResourceUtils.java
+++ b/egovframework.mdev.imp.commngt/src/egovframework/mdev/imp/commngt/util/ComResourceUtils.java
@@ -180,6 +180,11 @@ public static boolean checkOldWebXml(IContainer container, InputStream oriCon, I
     	try {
 
     		DocumentBuilderFactory docBF = DocumentBuilderFactory.newInstance();
+    		// XXE(XML External Entity Injection, CWE-611) 취약점 방지
+    		docBF.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+    		docBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    		docBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+    		docBF.setXIncludeAware(false);
     		DocumentBuilder docBuilder = (DocumentBuilder) docBF.newDocumentBuilder();
     		
     		// AS-IS 시스템의 document
@@ -245,6 +250,11 @@ public static InputStream modifyWebXml(IContainer container, String fname, Input
     	try {
 
     		DocumentBuilderFactory docBF = DocumentBuilderFactory.newInstance();
+    		// XXE(XML External Entity Injection, CWE-611) 취약점 방지
+    		docBF.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+    		docBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    		docBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+    		docBF.setXIncludeAware(false);
     		DocumentBuilder docBuilder = (DocumentBuilder) docBF.newDocumentBuilder();
     		
     		// AS-IS 시스템의 document