Is it possible to make an XSS attack if you can inject an arbitrary file (any extension, like: .js, .html etc...) in
background-image CSS property? If yes, how to do it?
No, that's not possible.
A value to
background-image will be rendered as an image. Even an SVG with embedded script code would just be displayed as an image when loaded via
background-image. So XSS isn't possible here (the same way an arbitrary value to
<img src="..."> can never lead to XSS).
Even if you couldn't just change a
background-image value but inject new CSS, you most likely wouldn't be able to get XSS. The techniques to inject script code via CSS
In extreme cases, it might actually lead to issues, but not necessarily XSS, nor necessarily through the background-image style rule.
Extreme case number 1: Your browser vendor could have a vulnerability in the rendering engine for background-image which if exploited leads to code being executed. This is highly unlikely with modern browsers, but in theory it could be possible.
Extreme case number 4: The ::before and ::after CSS rules support the "content" style rule that can be used to insert pretty much arbitrary strings before or after content. there is currently a draft (https://drafts.csswg.org/css-content/) which proposes to extend this content style rule beyond the before/after limitation.