Since you don't check for the image format you can get served a SVG image with embedded JavaScript and CSS that could potentially run in your website context. I

Since you don't check for the image format you can get served a SVG image with embedded JavaScript and CSS that could potentially run in your website context. It's not that straightforward as just an image tag won't let attackers run any js by default, but inlining the image would.