XXE (https://www.owasp.org/index.php/XXE) found in upload servlet