Try to upload file some file with `debug=1` parametr (Uncomment line in html)We see `Parsing docx error`Create empty docx file, name him `test.docx`Open docx file with 7-zip Open `[Content_Types].xml`, this`s xml fileWhen you see xml file, you should think `Hmm, may be XXE vulnerability?`Now, use google for search all about XXE (XML ENTITY) (https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing)Try to watch file `/var/www/html/index.php` with SYSTEM ENTITY AND PHP I/O and XXE vulnInject in script your ENTITY (Change `yoursite` to url to your site (or link to file on file hosting))Update Content Type file in 7-zipCreate xxe.txt in root directory of your site and put into them this code: Upload file.Fine! You`re watch errors... Open Page Source Code (Ctrl + U)You`ll see errors Decode base64 from this error (From `http://?` to ` in <b>`)You got php code when you can watch flag named file `flaflaflag.php`Change in xxe.txt `/var/www/html/index.php` to `/var/www/html/flaflaflag.php` and update them on your site (or file hosting)Upload your docx againDecode base64 againYou`re great!