AIKIDO-2026-574383

TL;DR

MediaUploader::upload() and replace() store uploaded SVG files without sanitizing their contents. An SVG containing an onload handler, <script> tag, or foreignObject element is written to disk unchanged and runs in the browser when a victim opens or previews it, so the script can capture session cookies and CSRF tokens. The fix adds a pluggable sanitizer pipeline and strips executable content from SVG uploads by default through enshrined/svg-sanitize.