diff --git a/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/util/fileConversion/admin/files/xml/DefaultOrderImportXmlParserHandler.java b/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/util/fileConversion/admin/files/xml/DefaultOrderImportXmlParserHandler.java
index ac1da5f2e..25b98247f 100644
--- a/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/util/fileConversion/admin/files/xml/DefaultOrderImportXmlParserHandler.java
+++ b/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/util/fileConversion/admin/files/xml/DefaultOrderImportXmlParserHandler.java
@@ -225,6 +225,8 @@ public class DefaultOrderImportXmlParserHandler {
             //初始化工厂类以创建出XMLEventReader对象
             XMLInputFactory factory =
                     XMLInputFactory.newFactory();
+            factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+            factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
             is = file.getInputStream();
             //通过读取XML文件创建XMLEventReader
             XMLEventReader reader = factory.createXMLEventReader(is);