flawopen.com/XSS/SVG upload
Is SVG upload an XSS risk?
An uploaded SVG is a document, not merely pixels: it can contain active elements such as scripts and event handlers. Whether script runs depends on how the browser receives it — SVG used through <img> is placed in a restricted image context, while inline SVG, direct navigation, or document embedding can be active.
What makes SVG different from other image formats
Unlike PNG or JPEG, SVG is XML and can carry active content. Browsers disable scripting in restricted image contexts such as <img>, but that restriction does not apply when SVG is viewed directly or embedded as a document through <object>, <iframe>, or <embed>, or when markup is inserted inline. A user-uploaded “profile picture” can therefore become stored XSS if the application later serves it in an active context under the application origin. Browser behavior depends on context; do not treat an extension or image MIME type as sanitization.
Doing it safely
- ✓Use a maintained SVG sanitizer with an explicit allowlist before storage or display. Remove scriptable elements, event handlers, external references, and
foreignObjectunless the product requires them; do not sanitize XML with regular expressions. - ✓If users only need an image, rasterize SVG in an isolated, resource-limited process and serve the raster output. Keep the original outside the web root unless required.
- ✓Serve user uploads from a separate registrable domain that receives no application cookies. A sibling subdomain alone may still receive parent-domain cookies.
- ✓For any remaining untrusted SVG document, force download with Content-Disposition: attachment and
X-Content-Type-Options: nosniff, or render only in a restricted image context such as <img>. Avoid inline, <object>, <iframe>, and direct same-origin document serving.
FAQ
No. An extension and declared MIME type describe metadata, not the document’s active content. Verify the actual file format, then sanitize with an SVG-aware allowlist or convert it to a raster image if SVG features are unnecessary.
References
- OWASP XML Security Cheat Sheet
- MDN — SVG as an image and active document contexts
- OWASP — File Upload Cheat Sheet
- OWASP ASVS — sanitizing or sandboxing SVG scriptable content