diff --git a/src/main/java/servlets/module/challenge/XxeChallenge1OldWebService.java b/src/main/java/servlets/module/challenge/XxeChallenge1OldWebService.java
index 868563583..e71049f49 100644
--- a/src/main/java/servlets/module/challenge/XxeChallenge1OldWebService.java
+++ b/src/main/java/servlets/module/challenge/XxeChallenge1OldWebService.java
@@ -130,8 +130,11 @@ public static String readXml(InputStream xmlEmail) {
     Document doc;
     String result;
 
+    // XmlDocumentBuilder.xmlDocBuilder's own parameter comments document the safe value for
+    // each flag - this call was passing the unsafe value for every single one, leaving external
+    // entity/DTD resolution fully enabled and open to XXE-based file disclosure.
     DocumentBuilder dBuilder =
-        XmlDocumentBuilder.xmlDocBuilder(false, true, true, true, true, true);
+        XmlDocumentBuilder.xmlDocBuilder(true, false, false, false, false, false);
     InputSource is = new InputSource(xmlEmail);
 
     try {
diff --git a/src/main/java/servlets/module/lesson/XxeLesson.java b/src/main/java/servlets/module/lesson/XxeLesson.java
index 72e6faa4b..3b194b50f 100644
--- a/src/main/java/servlets/module/lesson/XxeLesson.java
+++ b/src/main/java/servlets/module/lesson/XxeLesson.java
@@ -139,8 +139,12 @@ public static String readXml(InputStream xmlEmail) {
     Document doc;
     String result;
 
+    // XmlDocumentBuilder.xmlDocBuilder's own parameter comments document the safe value for
+    // each flag - this call was passing the unsafe value for every single one, leaving external
+    // entity/DTD resolution fully enabled and open to XXE-based file disclosure, same as the
+    // matching call already fixed in XxeChallenge1OldWebService.
     DocumentBuilder dBuilder =
-        XmlDocumentBuilder.xmlDocBuilder(false, true, true, true, true, true);
+        XmlDocumentBuilder.xmlDocBuilder(true, false, false, false, false, false);
     InputSource is = new InputSource(xmlEmail);
 
     try {