I see a big security problem with SVG: browsers allow executing scripts in SVG files in site security context, so you have to check for a lot of script execution vectors in SVG before you allow uploading user files.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;wikimedia&#x2F;mediawiki&#x2F;blob&#x2F;4aa9e1&#x2F;includes&#x2F;upload&#x2F;UploadBase.php#L1128" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;wikimedia&#x2F;mediawiki&#x2F;blob&#x2F;4aa9e1&#x2F;includes&#x2F;...</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;wikimedia&#x2F;mediawiki&#x2F;blob&#x2F;4aa9e1&#x2F;includes&#x2F;upload&#x2F;UploadBase.php#L1293" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;wikimedia&#x2F;mediawiki&#x2F;blob&#x2F;4aa9e1&#x2F;includes&#x2F;...</a>