The Avatar That Reads Your Files
DropZone lets members upload a profile picture. They accept PNG, JPG… and SVG, because 'it's just an image'. The upload handler parses every SVG on the server to check it's valid (dimensions, size) — and that parser processes external entities. An SVG is XML, so a picture can carry a DOCTYPE.
Objective
Upload an SVG avatar that reads a file on the server (try /etc/passwd, or an app config) and shows it back in the response.