diff --git a/server/internal/storage/util.go b/server/internal/storage/util.go
index 42c9bbb3f..8e474ff02 100644
--- a/server/internal/storage/util.go
+++ b/server/internal/storage/util.go
@@ -27,12 +27,22 @@ func sanitizeFilename(name string) string {
 // and can carry <script>, <foreignObject>, or onload= attributes that
 // execute in the document's origin when rendered inline. Forcing
 // attachment disposition prevents stored-XSS via uploaded .svg files.
+//
+// Input is normalized (trim, lowercase, strip parameters) before matching
+// so that values like "image/svg+xml; charset=utf-8" or "IMAGE/SVG+XML"
+// can't slip past the SVG carve-out. RFC 2045 §5.1 defines MIME type
+// matching as case-insensitive with optional parameters; this is the
+// security boundary, so normalize here instead of trusting callers.
 func isInlineContentType(ct string) bool {
-	if ct == "image/svg+xml" {
+	mediaType := strings.ToLower(strings.TrimSpace(ct))
+	if i := strings.IndexByte(mediaType, ';'); i >= 0 {
+		mediaType = strings.TrimSpace(mediaType[:i])
+	}
+	if mediaType == "image/svg+xml" {
 		return false
 	}
-	return strings.HasPrefix(ct, "image/") ||
-		strings.HasPrefix(ct, "video/") ||
-		strings.HasPrefix(ct, "audio/") ||
-		ct == "application/pdf"
+	return strings.HasPrefix(mediaType, "image/") ||
+		strings.HasPrefix(mediaType, "video/") ||
+		strings.HasPrefix(mediaType, "audio/") ||
+		mediaType == "application/pdf"
 }
diff --git a/server/internal/storage/util_test.go b/server/internal/storage/util_test.go
index 34479e149..466b2299b 100644
--- a/server/internal/storage/util_test.go
+++ b/server/internal/storage/util_test.go
@@ -17,6 +17,18 @@ func TestIsInlineContentType(t *testing.T) {
 
 		// SVG must NOT render inline — it can carry executable script.
 		{"image/svg+xml", false},
+		// MIME types are case-insensitive (RFC 2045 §5.1) and may carry
+		// parameters. The SVG carve-out is a security boundary, so any
+		// variant that resolves to image/svg+xml must also be blocked.
+		{"IMAGE/SVG+XML", false},
+		{"Image/Svg+Xml", false},
+		{"image/svg+xml; charset=utf-8", false},
+		{"image/svg+xml;charset=utf-8", false},
+		{"  image/svg+xml  ", false},
+		// Normalization must not break the positive cases either.
+		{"IMAGE/PNG", true},
+		{"image/png; foo=bar", true},
+		{"  application/pdf", true},
 
 		{"text/html", false},
 		{"application/octet-stream", false},