The Upload Filter (Blind XXE)
DropZone patched the avatar upload after the last report — the validator now rejects direct local-file references in uploaded SVGs. It still allows remote DTD references, and the XML parser still expands them. You can't place file:///etc/hostname directly in the upload anymore, so make the parser fetch a remote DTD that performs the read for you.
Objective
Exfiltrate the contents of /etc/hostname using blind XXE — your SVG can't read files back in the response, so exfiltrate out-of-band to your listener.