Stored XSS via SVG Upload in chat.line.biz

Summary

The web application allowed users to upload SVG files via chat.line.biz without properly filtering or disabling scripts embedded inside the SVG content. As a result, an attacker could upload a malicious SVG containing JavaScript, and when another user later opened this file in the management interface, the embedded script would be executed in the browser, leading to a stored cross-site scripting (Stored XSS) vulnerability.