Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Corbin's avatar

Can Laravel's image validation be spoofed as a malicious file by changing mime types while trying to save images asynchronously?

I'm using Vues root instance to save a file object to a data property and then I pass that property to another component like so:

Root

data: {
    imageFile: null,
},

methods: {
    onFileChange: function(e) {
        this.imageFile = e.target.files[0];
    }
}

ExampleComponent.vue

props: ['imgFile'],

data() {
    return {
        internalImageObj: null
    }
}

watch: {
  imageFile: function (newVal) {
    let reader  = new FileReader()
    reader.readAsDataURL(newVal)
    reader.addEventListener('load', () => {
      this.internalImageObj = reader.result
    }, false)  
  }
},

methods: {
    submitFile: function(){ 

        const imageFormData = new FormData();
        imageFormData.append('image', this.imgFile);

        axios({
          method: 'POST',
          url: '/image',
          data: imageFormData,
          headers: {
             'Content-Type': 'multipart/form-data'
          }
        }).then(function (response) {


        this.message = "Your image has been submitted";   

        }.bind(this))
        .catch(function (error) {
          console.log(error);
        });
    }
}

Html

<example-component :img-file="imageFile"></example-component>

Controller

public function image(Request $request)
{
    $request->validate([
        'image' => 'image',
    ]);

    //Store image
}

I'm pretty sure Laravel uses mime types to judge whether or not a file is an image in validation. Couldn't I just intercept the File object somewhere in this process and change the mime type to be an image allowing for the ability to execute a potentially malicious file on my server?

Can someone explain how and why this may or may not be possible and what can be done about it? How exactly would laravels image validator protect against this?

0 likes
0 replies

Please or to participate in this conversation.