Bug bounty write-up: XXE bug leading to LFI | Dark Hacker News