Dojo challenge #34 winners!

This report documents an XML External Entity (XXE) vulnerability in an AI image-generation web app where the XML SAX parser allows external general entities and a simple blacklist can be bypassed by submitting UTF-16-encoded, base64-wrapped XML. The author provides code analysis, example payloads (including a PoC that reads /etc/passwd and /tmp/flag.txt), an automation script, a risk assessment, and remediation guidance (disable external entities, use secure parsers, validate inputs).