Reading /etc/passwd via Translation Upload in Tolgee

Tolgee's XML translation importers ship with zero security config. Upload a crafted file, read anything from the server. Confirmed on their cloud platform.