Since SVG is built heavily if not entirely on XML, can one of the attacks that can be carried out through XML such as XXE injection be carried out from an SVG file?


XXE vulnerabilities are all to do with the parser. If the parser that processes the SVG file grabs external entities without verification, then it is vulnerable.

For an example, see this vulnerability in an Apache library.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.