Test files › Images › svg-with-script.svg
Sample SVG file
SVG containing an inline <script> block and an onload attribute. The payload only calls console.log and sets document.title - it is inert and does not exfiltrate anything.
↓ Download svg-with-script.svg| Filename | svg-with-script.svg |
| Format | SVG |
| Size | 457 bytes (457 bytes) |
| MIME type | image/svg+xml |
| SHA-256 | cda5b1d93e5c72c74f1f3444232e2b52a927757aa6e240bcf724a0748408d623 |
What this file catchesThe single most commonly missed upload vulnerability: serving user-uploaded SVG from your own origin executes script in your security context. Your handler should either sanitise the markup or serve it with Content-Disposition: attachment and a restrictive CSP.
Download & verify
curl -fsSL -o "svg-with-script.svg" "https://files.hexaqa.com/image/svg-with-script.svg"
curl -fsSL "https://files.hexaqa.com/image/svg-with-script.svg" | sha256sum
# expect: cda5b1d93e5c72c74f1f3444232e2b52a927757aa6e240bcf724a0748408d623