Zend_File_Transfer had a potential MIME type injection vulnerability for file
uploads. In certain situations where either PHP's
ext/finfo extension is not
installed and the
mime_content_type() function was not available on a system,
Zend_File_Transfer would use the user provided value for the type embedded
$_FILES superglobal. Additionally, in cases where the functionality
was available, but where a type could not be determined by one of them,
Zend_File_Transfer would also fallback on the user provided type. Using user
provided information for a file's MIME type in uploads is considered an insecure
practice, as it provides attack vectors by malicious users.
This vulnerability has been fixed by returning
application/octet in situations
where the MIME type cannot be detected securely by PHP.
If you use this component, or other components that rely on it (e.g.,
Zend_Form_Element_File), we strongly recommend upgrading to the most current
version of Zend Framework available, or one of the following versions.
The Zend Framework team thanks the following for working with us to help protect its users:
Have you identified a security vulnerability?
Please report it to us at firstname.lastname@example.org