Language: PHP
Label: vulnerable
CWE: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

Code:
	public function fileExt($check, $exts)
	{
		$file = $check[key($check)];
		if (!is_array($exts)) {
			$exts = explode(',', $exts);
		}

		// FILES形式のチェック
		if (!empty($file['name'])) {
			$ext = decodeContent($file['type'], $file['name']);
			if (!in_array($ext, $exts)) {
				return false;
			}
		}

		// 更新時の文字列チェック
		if (is_string($file)) {
			$ext = pathinfo($file, PATHINFO_EXTENSION);
			if (!in_array($ext, $exts)) {
				return false;
			}
		}
		return true;
	}