SVG MIME Type

About SVG image files

SVG is XML text, so it compresses very well. In <img> tags, scripts inside an SVG never run, but an SVG opened directly or embedded with <object> or <iframe> can run JavaScript. That makes user-uploaded SVGs an XSS risk: serve them from a separate domain, with Content-Disposition: attachment, or with Content-Security-Policy: script-src 'none'.

• Pre-compressed .svgz files need Content-Encoding: gzip in addition to image/svg+xml, or browsers show an error.

File signature

SVG has no fixed signature: it is text without a magic number, so validate uploads by parsing the content rather than by checking bytes.

Serve .svg with the right Content-Type

Content-Type: image/svg+xml; charset=utf-8

image/svg+xml svg svgz;

AddType image/svg+xml .svg .svgz
AddCharset UTF-8 .svg .svgz

@svg path *.svg *.svgz
header @svg Content-Type "image/svg+xml; charset=utf-8"

curl -sI https://example.com/file.svg | grep -i '^content-type'
# Content-Type: image/svg+xml; charset=utf-8

Set the type in code

res.set('Content-Type', 'image/svg+xml; charset=utf-8');

import mimetypes

mimetypes.add_type('image/svg+xml', '.svg')  # if your system doesn't know it
mimetypes.guess_type('file.svg')[0]  # 'image/svg+xml'

mime.AddExtensionType(".svg", "image/svg+xml; charset=utf-8")
w.Header().Set("Content-Type", "image/svg+xml; charset=utf-8")

Accept .svg uploads

<input type="file" accept=".svg,.svgz,image/svg+xml">

The accept attribute only filters the file picker; users can still choose another file. Listing the extension as well as the type matters, because operating systems don’t always report the type you expect.

Related types

• .png (image/png): PNG image
• .webp (image/webp): WebP image
• .html (text/html): HTML
• .xml (application/xml): XML

More web

.css , .js , .mjs , .wasm , .webmanifest , .rss , .vtt . Look up any extension or type with the MIME type lookup.

Sources

• IANA registration: image/svg+xml
• MDN: Common media types

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions