Hello,

Consider multiuser environment on b2evo.

1. Register and get permission to create blog and start new post.
2. Create text file with any html code you would like to run on server, rename extension to .jpg, f.e., and upload.
3. Get the full URL to uploaded file and run it in IE.

IE will render html code and will not consider the file extension.

Check for file extension in b2upload.php is not enough, you need to check mime type of image using getimagesize also.

Will someone post a fix or I can do that?