Medium
XXE
FlightLog GPX out-of-band XXE
A pilot logbook. Parsed content is never reflected back, but the parser still resolves external entities.
PentestingHere Academy
Official Academy lab
- Attempts
- 0
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
FlightLog imports GPX flight logs. Nothing from the parsed document is ever shown back to you directly.
Goal
Read the server-side file /etc/flightlog/ops-notes.txt (the flag). Nothing is shown back to you, so you will need to send its contents out of band; the lab hosts its own capture endpoint for exactly this.