A library upload form rejects filenames ending in .php but accepts the same script contents when renamed with an image extension and a matching Content-Type. What validation weakness does this demonstrate?
Select an answer to reveal the explanation.
Short Explanation
Putting a fruit sticker on a sandwich does not make it fruit. Extension and Content-Type labels are stickers — if the server never peeks inside, dangerous content can still land. Strong uploads check content, type, and where the file will live.
Full Explanation
Weak upload validation that trusts filename extensions or client-supplied MIME types is a common bypass path. Defensible controls combine server-side content inspection, strict allowlists, randomized storage names, and non-executable locations. Testers should report insufficient validation as a class rather than publishing bypass cookbooks. Unrelated mobile pinning or claims of perfect scanning do not describe this failure mode.