I can bypass an avatar upload image verification process and upload a PHP file or any other extension binding a valid jpeg image.

This is the code:

if ($image->valid()) {
            $mimeType = $image->mimeType();
            if ($mimeType !== 'image/jpeg' && $mimeType !== 'image/png') {
                return new DataResponse(
                    ['data' => ['message' => $this->l->t('Unknown filetype')]],

For example:

  1. download image1.jpg

  2. as you can see if you open the file image1.jpg file on notepad it hides PHP code ( phpinfo(); function in this case.

  3. rename image1.jpg to image1.php, and try to upload it on the avatar upload form. It passes verification.

How to secure this code?

  • 1
    Check the file extension before the mime type? Is that not an option?
    – Matthew
    Jul 6, 2018 at 8:27
  • 1
    This may be of use nullcandy.com/php-image-upload-security-how-not-to-do-it
    – jrtapsell
    Jul 6, 2018 at 9:16
  • 3
    I don't think anyone can really evaluate the code if you don't include the code... You've left out the most important pieces. Checking the mime type is a good security step depending on how you calculate the mime type, which is the part you left out. Jul 6, 2018 at 10:13
  • 1
    Why not check how phpbb handles file filtering ?
    – Overmind
    Jul 6, 2018 at 12:23

1 Answer 1


Since we don't know what processing is being done, we can't comment on how secure this is.

The only safe way to handle image uploads is:

1) never use the user supplied name/path (but you can store it / include it in output if properly escaped, but never write this back to your filesystem)

2) store the content outside of the document root and mediate all subsequent access via a control script

3) at upload, extract and create the image raster from the file and re-encode this into the file you will be keeping

  • Not entirely sure I agree with point 2 (depending on the scenario), and for point 3 I've seen imagemagick used often enough, which has had some pretty serious vulnerabilities in the past, including RCE. Jul 6, 2018 at 13:55
  • Yes, software has vulnerabilities - but the lower in the stack you go (in this case a packaged library rather than scripted code) the faster vulnerabilities are identified/fixed and the easier and cheaper is to get the fix deployed.
    – symcbean
    Jul 6, 2018 at 14:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .