AIKIDO-2026-10357

TL;DR

Affected versions of this package could allow inconsistent or overly permissive MIME validation during file uploads, causing the system to trust incorrect declared or stored content types, mishandle allow/deny rules, and persist misleading metadata such as application/octet-stream instead of the validated type. An attacker might exploit this by disguising a malicious file as an allowed format, abusing weak validation order or allow-list enforcement to upload content that is later served with an unsafe or misleading Content-Type, potentially increasing the risk of dangerous file delivery, content spoofing, or bypass of upload restrictions.