Chaining XSS, SSRF, and deserialization vulnerabilities to get RCE
LFI to RCE on GitLab 12.8.1~12.9.0