Rating:

XXE -> PHar injection -> Bash injection

Original writeup (https://wiki.armiaprezesa.pl/books/midnight-sun-2019/page/rubenscube).