The Web Client in Cerberus FTP Server Enterprise prior to 10.0.19 and 11.x prior to 11.0.4 allows XSS via an SVG document.
cerberusftp ftp server