$_FILES’ type Is Not Safe

By Alexandre Daubois

<?php

// curl -F "avatar=
@shell
.php;type=image/png"
if (isset($_FILE['upload']['type'])) {
    print $_FILE['upload']['type']; 
}

$_FILES[‘avatar’][‘type’] in PHP is a string the attacker typed.🔐

main/rfc1867.c reads the Content-Type header of the multipart part, cuts it at the first “;” and hands it to you. No sniffing. No validation. NOTHING reads the bytes on disk.

curl -F “avatar=

@shell

.php;type=image/png“ and your check sees image/png.

finfo_file() on tmp_name is the one that actually opens the file.

See Also

• Original Tweet
• Mastering PHP File Uploads: A Deep Dive into the $_FILES Array
• $_FILES type is an external string [Try me]

PHP Features

• $_files
• move_uploaded_file
• finfo

Last updated: 11 October 2026