Web Vulnerabilities
Magic Bytes
Also: file signature
The first few bytes of a file that identify its real format, such as the PNG signature.
In more detail
A file name or a declared content type is only a claim from the sender. Checking the leading bytes is a better test of what the file is, though still not proof it is harmless, so uploads should also be re-encoded or scanned and stored where they cannot run.