What are potential security risks when using the FILEINFO_MIME_TYPE function in PHP for file uploads?

The potential security risk when using the FILEINFO_MIME_TYPE function in PHP for file uploads is that it relies on the file extension or content to determine the MIME type, which can be manipulated by an attacker to upload malicious files. To mitigate this risk, it is recommended to validate the file type using both FILEINFO_MIME_TYPE and checking the file extension. 

$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $_FILES['file']['tmp_name']);
$allowed_types = array('image/jpeg', 'image/png', 'image/gif');

if (in_array($mime, $allowed_types) && in_array(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION), array('jpg', 'jpeg', 'png', 'gif'))) {
    // Process the file upload
} else {
    // Display an error message or reject the file upload
}

finfo_close($finfo);

Keywords

FILEINFO_MIME_TYPE PHP security risks file uploads vulnerabilities

Related Questions