$_FILES’ type Is Not Safe¶

By Alexandre Daubois

<?php

// curl -F "avatar=
@shell
.php;type=image/png"
if (isset($_FILE['upload']['type'])) {
    print $_FILE['upload']['type'];
}

$_FILES[‘avatar’][‘type’] in PHP is a string the attacker typed.🔐

main/rfc1867.c reads the Content-Type header of the multipart part, cuts it at the first “;” and hands it to you. No sniffing. No validation. NOTHING reads the bytes on disk.

curl -F “avatar=

@shell

.php;type=image/png” and your check sees image/png.

finfo_file() on tmp_name is the one that actually opens the file.

PHP Features¶

$_files
move_uploaded_file
finfo

Last updated: 18 August 2026

$_FILES’ type Is Not Safe¶

See Also¶

PHP Features¶