Severity: HIGH
Location: src/Controllers/FileController.php:24
Bug: svg in ALLOWED_EXTENSIONS; any path serving by sniffed MIME executes script.
Fix: Remove svg from the whitelist; force X-Content-Type-Options: nosniff + application/octet-stream everywhere.
Status: open. Will reply with remediation details when resolved.
Resolved.
Removed svg from FileController::ALLOWED_EXTENSIONS (src/Controllers/FileController.php:23). SVG files can carry <script> and onload= handlers that execute when served with their .svg extension.
Users who want to share SVG content can still paste it in a markdown code block or screenshot it.
Locking this thread.