fix: wrap fs.readFile in try/catch and move tempFilePath onto File type

Author: PatrikKozak

packages/payload/src/uploads/checkFileRestrictions.ts

@@ -87,12 +87,16 @@ export const checkFileRestrictions = async ({
     return
   }
 
-  // When useTempFiles is enabled, file.data is an empty buffer because the content
-  // is stored on disk at tempFilePath instead. Read the actual content so all
-  // content-based validation (MIME detection, SVG safety, PDF integrity) still works.
+  // file.data is empty when the content is on disk (tempFilePath). Read it so content validation works.
   let fileData = file.data
   if ((!fileData || fileData.length === 0) && file.tempFilePath) {
-    fileData = await fs.readFile(file.tempFilePath)
+    try {
+      fileData = await fs.readFile(file.tempFilePath)
+    } catch {
+      throw new ValidationError({
+        errors: [{ message: 'Could not read uploaded file for validation.', path: 'file' }],
+      })
+    }
   }
 
   // Secondary mimetype check to assess file type from buffer

packages/payload/src/uploads/types.ts

@@ -316,7 +316,7 @@ export type UploadConfig = {
 }
 export type checkFileRestrictionsParams = {
   collection: CollectionConfig
-  file: { tempFilePath?: string } & File
+  file: File
   req: PayloadRequest
 }
 
@@ -341,6 +341,10 @@ export type File = {
    * The size of the file in bytes.
    */
   size: number
+  /**
+   * Path to the temp file on disk when useTempFiles is enabled. In this case file.data will be an empty buffer.
+   */
+  tempFilePath?: string
 }
 
 export type FileToSave = {

test/uploads/int.spec.ts

@@ -1194,6 +1194,63 @@ describe('Collections - Uploads', () => {
             }),
           ).rejects.toMatchObject({ name: 'ValidationError' })
         })
+
+        it('should allow a valid image file when useTempFiles is enabled', async () => {
+          const pngData = await fs.promises.readFile(path.resolve(dirname, './image.png'))
+          const tmpFile = path.join(os.tmpdir(), `payload-test-${randomUUID()}.png`)
+          createdTmpFiles.push(tmpFile)
+          await fs.promises.writeFile(tmpFile, pngData)
+
+          const mockReq = {
+            payload: {
+              config: { upload: { useTempFiles: true } },
+              logger: { warn: () => {}, error: () => {} },
+            },
+          } as unknown as PayloadRequest
+
+          await expect(
+            checkFileRestrictions({
+              collection: {
+                slug: 'test',
+                upload: { mimeTypes: ['image/*'], staticDir: '/tmp' },
+              } as any,
+              file: {
+                data: Buffer.alloc(0),
+                mimetype: 'image/png',
+                name: 'valid.png',
+                size: pngData.length,
+                tempFilePath: tmpFile,
+              },
+              req: mockReq,
+            }),
+          ).resolves.not.toThrow()
+        })
+
+        it('should throw ValidationError when tempFilePath is missing and file.data is empty', async () => {
+          const mockReq = {
+            payload: {
+              config: { upload: { useTempFiles: true } },
+              logger: { warn: () => {}, error: () => {} },
+            },
+          } as unknown as PayloadRequest
+
+          // No tempFilePath — falls through to extension-based check, which should still reject
+          await expect(
+            checkFileRestrictions({
+              collection: {
+                slug: 'test',
+                upload: { mimeTypes: ['image/*'], staticDir: '/tmp' },
+              } as any,
+              file: {
+                data: Buffer.alloc(0),
+                mimetype: 'text/html',
+                name: 'malicious.html',
+                size: 0,
+              },
+              req: mockReq,
+            }),
+          ).rejects.toMatchObject({ name: 'ValidationError' })
+        })
       })
     })
   })