Lab: Exploiting XXE via image file upload
Summary: This PortSwigger lab has users attach avatars to comments, with the Apache Batik library processing the uploaded avatar image files. The lab requires uploading an image that displays the contents of the /etc/hostname file after processing, then submitting the server hostname value, exploiting the fact that the SVG image format uses XML.
What's compelling: An image upload feature backed by an XML-processing library like Apache Batik is enough to read files off the server, so any avatar or document upload path that parses XML deserves the same scrutiny as your API endpoints.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026