XXE in File Uploads: SVG, DOCX and Other XML-Backed Formats
An image upload or document import does not look like an XML endpoint — but SVG, OOXML and SAML are XML under the hood, and they reach a parser all the same. Here is how XXE hides behind a feature that never mentions XML, and the parser settings that close it everywhere.