Looks like MediaWiki (the software behind WIkipedia) verifies that the MIME type matches the extension: "MediaWiki tries to detect the MIME type of the files you upload, and rejects the file if the file-extension does not match the mime type" (https://www.mediawiki.org/wiki/Manual:MIME_type_detection) However, MIME types can be spoofed... (http://security.stackexchange.com/questions/35933/how-can-i-...)