From 789964358081b3050f931d024a55b03421d5f052 Mon Sep 17 00:00:00 2001
From: plegall <plg@piwigo.org>
Date: Tue, 21 Apr 2026 14:32:43 +0200
Subject: [PATCH] fixes GHSA-j9q6-q52g-g8jw make sure SVG files have the
 appropriate file name extension

---
 admin/include/functions_upload.inc.php | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/admin/include/functions_upload.inc.php b/admin/include/functions_upload.inc.php
index 474062bd3..120f73aab 100644
--- a/admin/include/functions_upload.inc.php
+++ b/admin/include/functions_upload.inc.php
@@ -253,6 +253,24 @@ SELECT
     {
       $original_extension = strtolower(get_extension($original_filename));
 
+      $finfo = finfo_open(FILEINFO_MIME_TYPE);
+      $finfo_type = finfo_file($finfo, $source_filepath);
+      finfo_close($finfo);
+
+      if (in_array($finfo_type, ['image/svg', 'image/svg+xml']) and $original_extension != 'svg')
+      {
+        unlink($source_filepath);
+        $error_msg = 'File extension "'.$original_extension.'" for file "'.$original_filename.'" does not match file MIME type "'.$finfo_type.'"';
+        if (defined('IN_WS'))
+        {
+          global $service;
+          $service->sendResponse(new PwgError(415, $error_msg));
+          exit;
+        }
+
+        die($error_msg);
+      }
+
       if (in_array($original_extension, $conf['file_ext']))
       {
         $file_path.= $original_extension;