Why Laravel's getClientMimeType() Is a Security Trap and What to Use Instead

A developer article highlights a common but dangerous file upload validation mistake in Laravel: using getClientMimeType(), which reads the browser-supplied Content-Type header rather than inspecting the actual file content. An attacker can rename a PHP file with a .jpg extension, set the header manually, and bypass such checks entirely. Laravel's two safe validation rules — mimes and mimetypes — both ultimately call getMimeType(), which reads the file from disk, making them immune to client-supplied spoofing. The framework also includes a secondary safeguard that blocks uploads with PHP-related extensions in the original filename, regardless of content analysis results. The author has published a Semgrep static analysis rule set called stacksec to automatically flag dangerous uses of getClientMimeType() in Laravel codebases.