As the error indicates, it seems that your CSV input seems to contain
characters that are not valid in XML. There are various ways to tackle
this; one looks as follows:

 (: interpret client data as Base64 :)
 declare
    %rest:path("/upload")
    %rest:POST("{$body}")
    function local:store-csv($body as xs:base64Binary)
  {
    (: replace invalid characters with a question mark :)
    let $input := bin:from-octets(
      bin:to-octets($body) ! (if(. >= 32 or . = (9, 10, 13)) then . else 63)
    )
    (: convert to XQuery Unicode string; convert to XML :)
    let $string := bin:decode-string($input, 'CP1251')
    return csv:parse($string)
  };

There may be easier solutions as well (I’ll give you an update once I
remember them ;).