diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index 6c9f1698..12b0f68e 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -3141,10 +3141,13 @@ class HttpCli(object):
         if len(ext) > 11:
             ext = "~" + ext[-9:]
 
+        return self.tx_svg(ext, exact)
+
+    def tx_svg(self, txt: str, small: bool = False) -> bool:
         # chrome cannot handle more than ~2000 unique SVGs
         # so url-param "raster" returns a png/webp instead
         # (useragent-sniffing kinshi due to caching proxies)
-        mime, ico = self.ico.get(ext, not exact, "raster" in self.uparam)
+        mime, ico = self.ico.get(txt, not small, "raster" in self.uparam)
 
         lm = formatdate(self.E.t0, usegmt=True)
         self.reply(ico, mime=mime, headers={"Last-Modified": lm})
@@ -3409,7 +3412,7 @@ class HttpCli(object):
             return True
 
         if "th" in self.ouparam:
-            return self.tx_ico("a.e" + pt[:3])
+            return self.tx_svg("e" + pt[:3])
 
         t = t.format(self.args.SR)
         qv = quotep(self.vpaths) + self.ourlq()
@@ -3791,8 +3794,8 @@ class HttpCli(object):
             if idx and hasattr(idx, "p_end"):
                 icur = idx.get_cur(dbv.realpath)
 
+        th_fmt = self.uparam.get("th")
         if self.can_read:
-            th_fmt = self.uparam.get("th")
             if th_fmt is not None:
                 nothumb = "dthumb" in dbv.flags
                 if is_dir:
@@ -3822,7 +3825,7 @@ class HttpCli(object):
                                 break
 
                     if is_dir:
-                        return self.tx_ico("a.folder")
+                        return self.tx_svg("folder")
 
                 thp = None
                 if self.thumbcli and not nothumb:
@@ -3836,6 +3839,9 @@ class HttpCli(object):
 
                 return self.tx_ico(rem)
 
+        elif self.can_write and th_fmt is not None:
+            return self.tx_svg("upload\nonly")
+
         elif self.can_get and self.avn:
             axs = self.avn.axs
             if self.uname not in axs.uhtml:
diff --git a/copyparty/ico.py b/copyparty/ico.py
index 1178f4a5..9788a0b6 100644
--- a/copyparty/ico.py
+++ b/copyparty/ico.py
@@ -8,7 +8,7 @@ import re
 
 from .__init__ import PY2
 from .th_srv import HAVE_PIL, HAVE_PILF
-from .util import BytesIO  # type: ignore
+from .util import BytesIO, html_escape  # type: ignore
 
 
 class Ico(object):
@@ -98,6 +98,6 @@ class Ico(object):
   fill="#{}" font-family="monospace" font-size="14px" style="letter-spacing:.5px">{}</text>
 </g></svg>
 """
-        svg = svg.format(h, c[:6], c[6:], ext)
+        svg = svg.format(h, c[:6], c[6:], html_escape(ext, True))
 
         return "image/svg+xml", svg.encode("utf-8")