Media type · image/svg+xml
image/svg+xml
image/svg+xml is the media type for SVG: scalable vector graphics written in XML.
Key facts
| Type | image/svg+xml |
|---|---|
| Extensions | .svg, .svgz |
| Standard | W3C SVG |
| Text or binary | Text (XML) |
| Scripting | Possible inside the file |
What image/svg+xml is
SVG describes shapes, paths, text and gradients as XML. Because it is vector, it stays sharp at any size and is ideal for logos, icons and diagrams. It can be embedded with <img>, used as a CSS background, or inlined into HTML for styling with CSS.
Security: SVG is executable content
An SVG file can contain <script>, event handlers and external references. Serving user-uploaded SVG from your own origin can become stored cross-site scripting. Serve uploads from a separate origin or a download-only endpoint, sanitize the XML, and add a restrictive Content-Security-Policy. For icons you control, the risk is lower but still worth treating as code.
Frequently asked questions
Why is an SVG upload dangerous?
SVG can carry scripts and event handlers. If it is served from your domain and opened directly, it can run in your origin's context.
Can I use SVG for photographs?
No. SVG is for vector shapes. Photographs are raster data and belong in JPEG, WebP or AVIF.