PHP upload validated by client MIME type in $_FILES
Rule ID: vetkit.php.file-upload.client-mime-type-trusted
An upload is validated by the MIME type the client sent ($_FILES[...]['type'] / getClientMimeType()). The browser supplies that value and an attacker sets it freely, so the check does not restrict what gets stored.
Last updated:
Suite: Security
php
An upload is validated by the MIME type the client sent ($_FILES[...]['type'] / getClientMimeType()). The browser supplies that value and an attacker sets it freely, so the check does not restrict what gets stored.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Detect the type from the file contents (finfo_file / mime_content_type / UploadedFile::getMimeType()) and check the extension against an allow-list; store the file under a server-generated name.
References
Source: packages/engine/rules/sast/php.yml.
Related checks
- PHP file upload stored under client-chosen filename
- PHP loose == hash comparison: type juggling auth bypass
- PHP strcmp() == 0 on request input allows auth bypass
- PHP unsafe reflection: class or method from request input
- PHP code injection: function name from request input
- PHP eval() code injection with non-literal value
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.