File type validation is a security control that checks whether an uploaded file really matches an allowed format before the application accepts it. The check should go beyond the filename or browser-supplied MIME type and inspect the file contents, extension, and sometimes size or structure. In practice, this helps prevent attackers from uploading scripts, executables, or malformed files disguised as harmless documents or images.
It matters because file-upload features are a common attack path in web applications and plugins. If validation is missing or weak, an attacker may place dangerous content on the server, sometimes leading to malware delivery, data theft, or remote code execution depending on how uploads are stored and served. Defenders reduce risk by using allowlists, renaming uploaded files, storing them outside the web root, and rejecting anything that does not match the expected format.