Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public function __construct($file_path, $allowed_mime = null) {

        $this->allowed_mime = $allowed_mime;

        $this->mime_types = (new cmsConfigs('mimetypes.php'))->getAll();

        $finfo = finfo_open(FILEINFO_MIME_TYPE);

        if(strpos($file_path, DIRECTORY_SEPARATOR) === 0){

            $this->file_mime = finfo_file($finfo, $file_path);

        } else {

            $this->file_mime = finfo_buffer($finfo, $file_path);
        }

        finfo_close($finfo);
    }