Forms enables you to control whether external entities
in XML inputs are resolved. By default, they are resolved, but you
can change this behavior to increase the security of your AEM forms
system.
Prevent
the processing of XML data files that contain references to external
entities
In administration console, click Services
> Forms.