---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Set Allowed MIME Child Types \[New in Security Center 2.0\]

# Set Allowed MIME Child Types \[New in Security Center 2.0\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Learn how to configure the
glide.security.mime.type.allowed_child_types property to a secure
setting so that file types will not pass the Multipurpose Internet Mail Extensions (MIME)
type checking. This reduces the risk of remote code execution on an uploaded
file.
The glide.security.mime.type.allowed_child_types property
defines the MIME file types that may have a file extension not matching the data
within an uploaded file. This allows such file types to bypass MIME type checking.
The property accepts a comma-separated list of file type pairs, such as
application/zip=application/java-archive. In this example,
if the property is set to such a value, files with a
.zip
extension that are technically
.jar
files are allowed to pass MIME type checking despite the inconsistency. If not set
properly, this bypass can lead to remote code execution of an uploaded file.
Therefore, it should always be set to an empty string ("") unless a valid use case
arises. For instance, if a certain MIME type must be allowed under a different file
extension and is valid as per the Tika configuration, then those key-value pairs
will be updated as part of this property value.

## More information {#sc_set_allowed_mime_child_types__section_qhx_1b1_xwb}

{#sc_set_allowed_mime_child_types__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.security.mime.type.allowed_child_types |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | string |
| Recommended value | "" |
| Default value | "" |
| Category | [File and resources](https://servicenow-prod.fluidtopics.net/5~TKzbBqQIVPVFIiiTAcxg "The file and resources category ensures applications handle untrusted file data securely and store untrusted data from untrusted sources with limited permissions in an appropriate location.") |
| Security risk | * Severity score: 4.6 * CVSS score: Medium * Security risk details: Not setting this property to the secure value could cause files with incorrect configurations to lead to remote code execution of an uploaded file. {#sc_set_allowed_mime_child_types__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | Yes, when glide.security.mime.type.detection.allow_child_types is set to true, the values of this property will be used to validate against the configured list of allowed MIME child types. |
| Functional impact | To support MIME types whose file extensions do not match the content of the files but are valid according to the Tika sub-type configurations in tika-mimetypes.xml. |
[ ]

{#sc_set_allowed_mime_child_types__table_ajc_b43_3kb}