[SECURITY] Profile image upload accepts SVG files without sanitization, allowing SVG-based script execution when images are rendered

[anshul23102]

Problem

The profile image upload endpoint does not restrict file types beyond checking the file extension. SVG files are XML documents that can contain embedded JavaScript in <script> tags and event handler attributes. When an SVG is uploaded as a profile image and rendered in an <img> tag, script execution is blocked by the browser's SVG-in-img sandbox. However, if the SVG is served inline or via a direct URL in an <object> or <embed> tag, the scripts execute in the page's origin context, enabling stored XSS.

Steps to Reproduce

1. Create a malicious SVG:

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)">
  <circle cx="50" cy="50" r="50"/>
</svg>

2. Upload it as a profile picture
3. Visit any page that renders this SVG in a non-sandboxed context

Proposed Fix

• Block SVG uploads entirely for profile images; accept only JPEG, PNG, and WebP
• Validate magic bytes in addition to the file extension
• If SVG support is required, sanitize the SVG server-side using svg-sanitize or DOMPurify with SVG namespace enabled

Complexity: Level 2 | Program: GSSOC '26

[anshul23102]

/assign

Claiming this issue for GSSoC '26. Please assign it to me, I'll start working on it right away.

[anshul23102]

Hi @Shivayan09, I'd like to work on this issue as part of GSSoC 2026. I'll add SVG sanitization to the profile image upload to prevent script execution from malicious SVG files. Could you please assign it to me?

/assign
/claim