diff --git a/app/Console/Commands/Internal/TransformImports.php b/app/Console/Commands/Internal/TransformImports.php
index da3491959..4a7f2d3d9 100644
--- a/app/Console/Commands/Internal/TransformImports.php
+++ b/app/Console/Commands/Internal/TransformImports.php
@@ -131,6 +131,10 @@ class TransformImports extends Command
             foreach ($ip->media as $ipm) {
                 $fileName = last(explode('/', $ipm['uri']));
                 $ext = last(explode('.', $fileName));
+                $ext = strtolower(last(explode('.', $fileName)));
+                if (! in_array($ext, ['jpg', 'jpeg', 'png', 'webp', 'mp4'], true)) {
+                    continue;
+                }
                 $basePath = MediaPathService::get($profile);
                 $og = 'imports/'.$id.'/'.$fileName;
                 if (! $disk->exists($og)) {
diff --git a/app/Http/Controllers/ImportPostController.php b/app/Http/Controllers/ImportPostController.php
index d00d6913f..4c16b403a 100644
--- a/app/Http/Controllers/ImportPostController.php
+++ b/app/Http/Controllers/ImportPostController.php
@@ -9,10 +9,19 @@ use App\Models\User;
 use App\Services\ImportService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Facades\Log;
 
 class ImportPostController extends Controller
 {
+    public const ALLOWED_EXTENSIONS = [
+        'image/jpeg' => ['jpg', 'jpeg'],
+        'image/jpg' => ['jpg', 'jpeg'],
+        'image/png' => ['png'],
+        'image/webp' => ['webp'],
+        'video/mp4' => ['mp4'],
+    ];
+
     public function __construct()
     {
         $this->middleware('auth');
@@ -223,6 +232,20 @@ class ImportPostController extends Controller
                 'file',
                 $mimes,
                 'max:'.config_cache('pixelfed.max_photo_size'),
+                function ($attribute, $value, $fail) {
+                    if (! $value instanceof UploadedFile) {
+                        $fail('The '.$attribute.' must be a file.');
+
+                        return;
+                    }
+
+                    $mime = $value->getMimeType();
+                    $ext = strtolower($value->getClientOriginalExtension());
+
+                    if (! in_array($ext, self::ALLOWED_EXTENSIONS[$mime] ?? [], true)) {
+                        $fail('The '.$attribute.' extension does not match its content.');
+                    }
+                },
             ],
         ]);