CVE-2026-75496: Insecure Client Mime Validationcve-2026-75496-insecure-client-mime-validation
Client-supplied MIME types from `$_FILES[...]['type']` or uploaded file metadata can be spoofed in the HTTP request. Relying on client-controlled MIME types for validation allows attackers to upload arbitrary files. Use server-side inspection such as `finfo_file()`, `mime_content_type()`, or file signature/magic bytes verification instead.
