> For the complete documentation index, see [llms.txt](https://www.webhackingtips.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.webhackingtips.com/weekly-tips/week-22-xss-through-svg-file.md).

# Week 22 - XSS Through SVG File

## XSS Through SVG File

It’s week 22 of the Web Hacking Series!

And I’ve got a tip for when you come across a file upload that only accepts images. If the application allows SVG image types, you may have just found yourself a stored XSS vulnerability!

Using the code in the below image, you can execute JavaScript on the victim application. Just copy into a file named ‘test.svg’ and upload it! Short, simple, and sweet.

![](https://3053998085-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxZo6Sim2dDXChJQAtNXN%2Fuploads%2FR86ItTF3isIT45d2iRRS%2F1654520003364.jpg?alt=media\&token=5f75d5da-8637-4cc3-850e-54f7ec006a39)

![](https://3053998085-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxZo6Sim2dDXChJQAtNXN%2Fuploads%2Fm4vwH936t32cylFNiMRH%2Fimage.png?alt=media\&token=2537dadb-c0e0-4c50-b101-f8892a386dd4)