---
title: "Important: #94492 - Introduce SVG Sanitizer"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:important-94492"
source: "Changelog/9.5.x/Important-94492-IntroduceSVGSanitizer.rst"
modified: "2026-09-14T09:47:36+00:00"
---

# Important: #94492 - Introduce SVG Sanitizer

See [forge#94492](https://forge.typo3.org/issues/94492)

## Description

SVG sanitization behavior of extension [t3g/svg-sanitizer](https://packagist.org/packages/t3g/svg-sanitizer)
has been introduced into TYPO3 core. Actual processing is done by low-level sanitization package
[enshrined/svg-sanitize](https://packagist.org/packages/enshrined/svg-sanitize) by Daryll Doyle.

### Introduced aspects

-   handle `GeneralUtility::upload_copy_move` invocations
-   handle FAL action events `file-add`, `file-replace`, `set-content`
-   provide upgrade wizard, sanitizing all SVG files in storages that
    are using `\TYPO3\CMS\Core\Resource\Driver\LocalDriver`

### Custom usage

```php
$sanitizer = new \TYPO3\CMS\Core\Resource\Security\SvgSanitizer();
$sanitizer->sanitizeFile($sourcePath, $targetPath);
$svg = $sanitizer->sanitizeContent($svg);
```

Basically this change enforces following public service announcements
concerning SVG files, to enhance these security aspects per default:

-   [TYPO3-PSA-2020-003: Mitigation of Cross-Site Scripting Vulnerabilities in File Upload Handling](https://typo3.org/security/advisory/typo3-psa-2020-003)
-   [TYPO3-PSA-2019-010: Cross-Site Scripting Vulnerabilities in File Upload Handling](https://typo3.org/security/advisory/typo3-psa-2019-010)