Pdf isnt too bad, it has javascript but generally is sandboxed so you cant do anything bad with it. SVG is basically the same as html, and you can do standard

Pdf isnt too bad, it has javascript but generally is sandboxed so you cant do anything bad with it. SVG is basically the same as html, and you can do standard XSS stuff. Hosting on separate domain (not just subdomain but actual separate domain) is a must if you allow formats like svg, and a good idea generally.