Insufficient sanitization of SVG file content during media upload allows authenticated users with the `media.create` permission to upload malicious SVG files containing script tags. When a user, including an administrator, opens the stored SVG file served inline from the application origin, the embedded JavaScript executes within the dashboard context. This can lead to session hijacking and administrative account takeover.