---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Validate MIME type for multi-extension filenames and polyglot files

# Validate MIME type for multi-extension filenames and polyglot files {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use a system property to prevent attachments from bypassing MIME-type restrictions.
Use the glide.attachment.enable_secure_filename_validation system property to enable strict validation of attachment file names. When set to true, this property prevents attachments from bypassing MIME-type restrictions. The platform performs full file name sanitization and rejects unsafe patterns that could otherwise be used to upload malicious files.

Add a record to the System Properties \[sys_properties\] table with the name <kbd class="ph userinput">glide.attachment.enable_secure_filename_validation</kbd> and a value of <kbd class="ph userinput">true</kbd>.

## More information {#sc-validate-mime-type-for-multi__section_wc1_cqn_phc}

{#sc-validate-mime-type-for-multi__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.attachment.enable_secure_filename_validation |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | false |
| Fallback value | false |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/Y54hkYpvZcFtgJ5PMM2JEw "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score:4.6 * CVSS score: Medium * Security risk details: MIME type validation for file attachments doesn't take place in multi-extension processing or when null bytes are present. This allows attackers to circumvent the glide.attachment.extensions and glide.security.file.mime_type.validation system properties through null-byte injection, multi-extension file names and polyglot files, leading to malicious file uploads. {#sc-validate-mime-type-for-multi__ul_g1g_3sf_xwb} |
| Functional impact | When the glide.attachment.enable_secure_filename_validation property is set to true: * Uploads that previously passed may now be rejected. * Integrations or automations that rely on generating file names with multiple dots or unusual patterns may fail until updated. * Custom UI pages, scoped apps, or API consumers that upload files programmatically (especially with templated file names) may see validation errors. * CI/CD pipelines that import files, ATF tests, or legacy scripts may need updates to confirm conforming file names. {#sc-validate-mime-type-for-multi__ul_y5m_1kj_xhc} Functionality that does not rely on unsafe file name patterns continue to work normally. |
| Dependencies and prerequisites | None |
[ ]

{#sc-validate-mime-type-for-multi__table_ajc_b43_3kb}