How it was found

Hello Ubuquiti,

Details

I was able to upload an svg file to here. so i uploaded an SVG file with XSS on its code and if the attacker give the link to his victim he can grab it's victim's cookie. and regarding to the your Upload image svg file it uploaded even it has an error..

PoC

link {F167791}

Fix

Dont allow to upload an svg file because attacker can put his payload to a SVG files.