Read the Server's Secrets
DropZone added a 'preview rendered' tab: paste XML, and the page renders any text element as visible content. The XML parser they use still processes external entities. A classic XXE trick reads a file by pointing an external entity at it and letting the app echo the file's contents back — try the platform's own filesystem first.
Objective
Read a file from the server (e.g. /etc/passwd) via an external entity and see its contents in the rendered preview.