Severity: CRITICAL
Location: src/Controllers/AdminBrandingController.php:287-288
Bug: image/svg+xml in allowed MIME list; SVG goes to public/assets/branding/ unchanged. SVG
Fix: Drop SVG from allowed MIMEs or run through an SVG sanitizer.
Status: open. Will reply with remediation details when resolved.
Resolved.
Removed image/svg+xml from the allowed-MIME list in AdminBrandingController::handleBrandingUpload (src/Controllers/AdminBrandingController.php).
Super admins can still upload JPG, PNG, WEBP for logos and covers, and ICO for the favicon — but SVG is refused with a clear error message explaining why.
Rationale: branding assets are loaded on every page, so one SVG containing <script> or onload= would be stored XSS against every visitor. Raster formats only avoids the need to embed an SVG sanitizer dependency.
If we need SVG branding in the future, the right fix is enshrined/svg-sanitize before storage — but that's a larger change with a new dependency; not worth shipping today.
Locking this thread.