Unable to upload PNG images after migrating to V12

I remember something about a vulnerability in the images directory whereby people could upload code posing as images...
There was a hotfix released early this year, I want to say January.

Maybe it's related to that?

HI Enes,

Francesca is correct in that sugar will reject any images with hidden tags in them. I recommend checking your sugar log for details on the rejection.

Hi,

This issue seems to be related to the same issue I have been experiencing with the Outlook Plugin. i.e. when trying to archive an email with PNG files embedded in the email, we received this error:

2023-05-02 15:23:07,675 [VSTA_Main] ERROR SugarOutlook.Archive.EmailArchiveController - [2.7.7:2016x32] [2.7.7:2016x32] Failed to archive some attachment(s) to Sugar
Sugar.API.REST.SugarServerException: Image format png is no longer supported.
at Sugar.API.REST.SugarServiceHandler.ProcessResponseStatusWithRetry(IRestResponse restResponse, Stream responseStream, Int32& retriesCount, Boolean failOnError)

I raised a case with Sugar and their reply was as follows: 

"...... The reported problem you are experiencing has been documented as Issue #92007 (portal.sugarondemand.com/ that we are working to address in a future release of Sugar. Please use the above link anytime for a real-time status update.

Currently, there is no workaround advised for this issue #92007.
Apologies for any inconvenience caused....."

Maybe keep an eye on issue #92007.

Hope this helps. 

Can we get an update on this issue?  Saw similar issue in 11.0.6 and wondering if this also still exists in Sugar 12.0.4 or 13... looks like the ticket is still "under consideration" ... ?

Hi Sean Nakamura ,

I agree with our community that your PNG might contain hidden tags that could pose a risk to Sugar and they'll be denied to upload, you can check the code in the include/utils.php of your instance (see function verify_image_file) for detailed algorithm.

Try to "vi" your PNG image and look for tags like (php, html, script, body, iframe, <full list in the algorithm above>), I guess you'll find some funky chars there.