I may have missed them but haven't seen where are you checking the MIME types. Where are you doing all the security checks?

If you didn't do it, please check how the com_media does them when uploading a file.