From b14f24fc61859fdc26772f04cc36b7af1e00c8cd Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Thu, 27 Aug 2026 21:35:56 -0700
Subject: [PATCH] Also filter other JS types

---
 mailboxes/detach.cgi | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mailboxes/detach.cgi b/mailboxes/detach.cgi
index ea419b7c8..09aa5ab90 100755
--- a/mailboxes/detach.cgi
+++ b/mailboxes/detach.cgi
@@ -100,7 +100,8 @@ else {
                         print "Content-type: $attach->{'type'}\n\n";
                         }
 		}
-	if ($attach->{'type'} =~ /^text\/html/i && !$in{'save'}) {
+	if ($attach->{'type'} =~ /^(text\/html|image\/svg|application\/xhtml)/i
+	    && !$in{'save'}) {
 		print &safe_urls(&filter_javascript($attach->{'data'}));
 		}
 	else {