Media type / image
image/svg+xml
Scalable Vector Graphics — an XML document, not a bitmap, which means it can contain scripts and external references.
Served inline: Rendered inline, this type executes script in the origin that served it. Never serve untrusted content under it from an origin that holds sessions — use a separate origin, or force a download with Content-Disposition: attachment.
Browser behaviour
Executes in the page
Charset
charset required
Compression
Compress in transit
Send it like this
Content-Type: image/svg+xml; charset=utf-8Send `; charset=utf-8`. Without it the receiver falls back to its own default — for some text types that default is us-ascii, and any non-ASCII character then renders wrong.
Handling verdict
Rendered inline, this type executes script in the origin that served it. Never serve untrusted content under it from an origin that holds sessions — use a separate origin, or force a download with Content-Disposition: attachment.
Send `; charset=utf-8`. Without it the receiver falls back to its own default — for some text types that default is us-ascii, and any non-ASCII character then renders wrong.
The payload is text-like or otherwise repetitive, so gzip or Brotli removes real bytes. Enable it at the server or CDN.
Registered with IANA through a public review process, so the name is stable and every implementation can rely on it meaning the same thing.
Anatomy of the name
RFC 6838Top-level type
image
Image
Subtype
svg+xml
Registered in the standards tree.
Structured syntax
+xml
The payload is well-formed XML, so generic XML tooling — parsers, XPath, schema validators — applies.
Parameters
charset
Beyond the charset rule above, this type defines no parameters of its own.
What trips people up
3 notes- The one image type that is genuinely dangerous: an uploaded SVG rendered inline can run JavaScript in your origin.
- Serve user SVGs from a separate origin, or with Content-Disposition: attachment and a restrictive CSP. In an <img> tag scripts do not run — but a direct link is not an <img> tag.
- Being XML, it compresses very well, unlike every other image type here.
Response headers
Content-Type: image/svg+xml; charset=utf-8
X-Content-Type-Options: nosniff
Content-Disposition: inline
Content-Security-Policy: sandbox; default-src 'none'
Vary: Accept-Encodingnosniff stops the browser second-guessing the type you declared, which is what makes the rest of this reliable. The sandbox directive is the belt-and-braces option when the content is not fully under your control.
Server configuration
extension mappingnginx
types {
image/svg+xml svg svgz;
}Apache
AddType image/svg+xml .svg .svgz
AddCharset UTF-8 .svg .svgzCaddy
@type path *.svg *.svgz
header @type Content-Type "image/svg+xml; charset=utf-8"Extensions and other spellings
with signatureFile extensions
File signature
3C 73 76 67 or 3C 3F 78 6D 6C
Check these bytes rather than the client-supplied Content-Type when validating an upload. The header is a claim; the signature is evidence.