Skip to main content
Drupal is a registered trademark of Dries Buytaert
Release: OpenID Connect / OAuth client 3.0.0-alpha9 New alpha version released for module openid_connect (3.0.0-alpha9). Usage Milestone: Google Analytics Module google_analytics crossed 1,000 active installs. Release: Timelinr 1.0.1 Minor update available for module timelinr (1.0.1). Release: GraphQL Compose Codegen 1.1.2 Minor update available for module graphql_compose_codegen (1.1.2). Release: Mapy.com 1.1.3 Minor update available for module mapycom (1.1.3). Release: Ckeditor5 entity browser 3.0.3 Minor update available for module ckeditor5_entity_browser (3.0.3). Release: Ckeditor5 entity browser 3.0.1 Minor update available for module ckeditor5_entity_browser (3.0.1). Release: Ckeditor5 entity browser 3.0.2 Minor update available for module ckeditor5_entity_browser (3.0.2). Release: Teamleader Integration 4.0.2 Minor update available for module teamleader (4.0.2). Module Revived: Entityqueue Buttons 1.1.2 Module entityqueue_buttons updated after 8 months of inactivity (1.1.2).

File Upload Secure Validator

12,142 sites Security covered Drupal 11 · not 10
View on drupal.org

This module enhances file uploads by performing more secure server-side validation. It checks the file's true MIME type against allowed extensions, rather than relying solely on the file name. This provides a more robust security measure for uploaded files.

This is a very simple and small module which performs a server side validation for the extension of an uploaded file of any content type's file field. Default drupal 7 file validation is performed by file_validate_extensions which only relies on the file name extension.
'File Upload Secure Validator' uses the php library 'fileinfo' and is dependent on that. Therefore the server hosting the drupal instance should have this library enabled. Through this php lib we can perform a more secure and reliable check on the file's mime type and compare that to the allowed file extensions, as these are set by the admin within the content type's field settings.

This module is useful when we need to enforce a maximum security mime type detection.

Dependencies
The module depends on the php library fileinfo. Please make sure this library is present and enabled on the server.

Installation
Install module like usual. No special installation considerations

Configuration
No configuration options. After enabling the module, it will perform an alternative server side extension validation on every uploaded file of every content type file field.

Depends on

Dependencies of the latest stable release

No dependencies recorded for this project.

Required by

Tracked projects that depend on this one

No tracked projects depend on this one yet.

Activity

Tracked releases
5
Tracked since
Dec 2025
Latest release
3 months ago
Releases (12 mo)
5 ▲ from 0
Maintenance
Active

Release Timeline

Releases

Version Type Core Release date
2.2.2 Stable 11 May 15, 2026
2.1.1 Stable 9–10 May 14, 2026
2.2.1 Stable 11 Dec 19, 2025
2.2.0 Stable 11 Dec 19, 2025
2.2.x-dev Dev 11 Dec 19, 2025