> For the complete documentation index, see [llms.txt](https://www.webhackingtips.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.webhackingtips.com/weekly-tips/week-22-xss-through-svg-file.md).

# Week 22 - XSS Through SVG File

## XSS Through SVG File

It’s week 22 of the Web Hacking Series!

And I’ve got a tip for when you come across a file upload that only accepts images. If the application allows SVG image types, you may have just found yourself a stored XSS vulnerability!

Using the code in the below image, you can execute JavaScript on the victim application. Just copy into a file named ‘test.svg’ and upload it! Short, simple, and sweet.

![](/files/mVzkdfA5jvmFOTyxezwb)

![](/files/WRSJu1vIRh4EKsPWlk4U)