SVG

Scalable Vector Graphics

Q: Are there security risks when users upload SVGs?

Yes. SVG files are essentially HTML-like documents that can contain embedded tags. If you allow users to upload SVGs and serve them directly from your main domain, attackers can execute Stored Cross-Site Scripting (XSS) attacks. Always sanitize user-uploaded SVGs using tools like DOMPurify, or serve them from a separate, sandboxed CDN domain.

image/svg+xml Released 2001 · by World Wide Web Consortium (W3C)

Scalable Vector Graphics (SVG) is the web standard for two-dimensional, XML-based vector graphics. Because it uses mathematical formulas (points, lines, curves, and shapes) rather than a grid of pixels, it scales infinitely without losing quality. The image/svg+xml MIME type is the officially registered IANA identifier. SVGs support CSS styling, DOM manipulation, SMIL animations, and JavaScript interactivity.

Web & Graphics Transparency Animation ✦ HDR Production Ready

Technical Specifications

MIME Type

image/svg+xml

Extensions

.svg.svgz

Container

XML Document

Compression

Uncompressed (Plain Text XML) & Lossless (GZIP via .svgz)

Algorithms

None (for .svg)GZIP (for .svgz)

Color Depth

Vector (Independent of bit-depth), CSS Colors (HEX, RGB, HSL, Display-P3)

Metadata

XMP

Capabilities

Transparency

Animation

Progressive Loading

Alpha Channel

HDR Support

Official Specification

Aliases: image/svg

Magic Bytes & HTTP Headers

File Signature (Magic Bytes)

3C 73 76 67 (for <svg) / 3C 3F 78 6D 6C (for <?xml)

ASCII: <svg / <?xml

HTTP Headers

Content-Type: image/svg+xml

Content-Encoding: gzip (Required ONLY if serving compressed .svgz files)

HTML Accept Attribute

accept="image/svg+xml, .svg, .svgz"

Browser Support Matrix

Browser	Status	Min Version
Chrome	Supported	All
Firefox	Supported	All
Safari	Supported	All
Edge	Supported	All
Internet Explorer	Supported	Legacy

Advantages & Limitations

Advantages

Provides infinite resolution scalability, looking perfectly crisp on high-DPI (Retina) displays without increasing file size
Extremely lightweight compared to raster formats for flat graphics, logos, and UI elements
Can be manipulated dynamically via the browser's CSS and JavaScript engines (DOM integration)

Limitations

Unsuitable for complex photographic images or photorealistic textures
Poses critical security vulnerabilities (XSS and XML External Entity attacks) if user-uploaded SVGs are not heavily sanitized
Rendering performance degrades significantly if the SVG contains tens of thousands of complex nodes or deeply nested paths

Developer Code Snippets

import magic
print(magic.from_file('vector.svg', mime=True)) # May output 'image/svg+xml' or occasionally 'text/xml' depending on the libmagic version

const isSvg = require('is-svg');
const fs = require('fs');
// Binary-focused libraries (like 'file-type') often fail on SVGs. Using regex/string-based validation like 'is-svg' is recommended.
console.log(isSvg(fs.readFileSync('vector.svg'))); // true

import "net/http"
// http.DetectContentType will often misidentify SVGs as "text/xml; charset=utf-8". You must write custom detection to check for the <svg> tag.

$mime = mime_content_type('vector.svg');
echo $mime; // Standard setups will identify it as 'image/svg+xml'

File Detection Steps

How to programmatically detect a image/svg+xml file by reading its raw bytes:

1 Check the initial bytes for plain text strings like '<?xml' or '<svg'
2 Parse the XML structure to ensure the root element is <svg> and belongs to the 'http://www.w3.org/2000/svg' namespace

Software Support

A

Adobe Illustrator

F

Figma

I

Inkscape

A

All Modern Web Browsers

Conversion Tools

Convert SVG to →

SVG WebP

Share & Embed

Markdown Badge

[![SVG Format](https://freewebptojpg.com/mime/image/svg/badge.svg)](https://freewebptojpg.com/mime/image/svg)

Interactive iframe Widget

<iframe src="https://freewebptojpg.com/mime/image/svg/embed" width="100%" height="280" style="border:1px solid #cbd5e1;border-radius:8px;" title="SVG Specs"></iframe>

JSON API

All data on this page is available as a free, open JSON API. Use it in your project, documentation, or tooling.

GET https://freewebptojpg.com/mime/image/svg.json Open JSON

Free to use

No auth required

CORS enabled

Use from any domain

Cached 24h

Cache-Control headers set

Frequently Asked Questions

Why is the MIME type image/svg+xml instead of just image/svg?

The '+xml' suffix is a standardized convention in IANA MIME types indicating that the format is based on XML. This allows HTTP clients and browsers to pass the file through a generic XML parser if a specialized SVG renderer is unavailable. Serving SVGs simply as 'image/svg' violates standards and can cause strict MIME-sniffing browsers to reject the file.

What is the magic byte for an SVG file?

Because SVG is a plain-text XML format, it lacks a traditional binary magic number. Identification relies on reading the first few bytes as ASCII/UTF-8. Files typically begin with the XML declaration (<?xml version="1.0"?>) or the opening tag (<svg>). The hex for '<svg' is 3C 73 76 67.

Are there security risks when users upload SVGs?

Yes. SVG files are essentially HTML-like documents that can contain embedded <script> tags. If you allow users to upload SVGs and serve them directly from your main domain, attackers can execute Stored Cross-Site Scripting (XSS) attacks. Always sanitize user-uploaded SVGs using tools like DOMPurify, or serve them from a separate, sandboxed CDN domain.