getgrav/grav · error · RuntimeException

SVG file XSS check failed on %s

Error message

SVG file XSS check failed on %s

What it means

Error "SVG file XSS check failed on %s" thrown in getgrav/grav.

Source

Thrown at system/src/Grav/Framework/Form/FormFlashFile.php:198

     * @return array
     */
    #[\ReturnTypeWillChange]
    public function jsonSerialize()
    {
        return $this->upload;
    }

    /**
     * @return void
     */
    public function checkXss(): void
    {
        $tmpFile = $this->getTmpFile();
        $mime = $this->getClientMediaType();
        if (Utils::contains($mime, 'svg', false)) {
            $response = Security::detectXssFromSvgFile($tmpFile);
            if ($response) {
                throw new RuntimeException(sprintf('SVG file XSS check failed on %s', $response));
            }
        }
    }

    /**
     * @return string|null
     */
    public function getTmpFile(): ?string
    {
        $tmpName = $this->upload['tmp_name'] ?? null;

        if (!$tmpName) {
            return null;
        }

        $tmpFile = $this->flash->getTmpDir() . '/' . $tmpName;

        return file_exists($tmpFile) ? $tmpFile : null;

View on GitHub (pinned to 6040efed04)

When it happens

Trigger: Thrown at system/src/Grav/Framework/Form/FormFlashFile.php:198 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of getgrav/grav@6040efed04 (2026-08-17). Data as JSON: /api/errors/d037f19b48b58389. Report an issue: GitHub.