Index: wp-admin/custom-header.php
===================================================================
--- wp-admin/custom-header.php	(revision 22252)
+++ wp-admin/custom-header.php	(working copy)
@@ -763,8 +763,14 @@
 	 */
 	function step_2_manage_upload() {
 		$overrides = array('test_form' => false);
-		$file = wp_handle_upload($_FILES['import'], $overrides);
 
+		$file = $_FILES['import'];
+		$wp_filetype = wp_check_filetype_and_ext( $file['tmp_name'], $file['name'], false );
+		if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) )
+			wp_die( __( 'The uploaded file is not a valid image. Please try again.' ) );
+
+		$file = wp_handle_upload($file, $overrides);
+
 		if ( isset($file['error']) )
 			wp_die( $file['error'],  __( 'Image Upload Error' ) );
 
Index: wp-admin/custom-background.php
===================================================================
--- wp-admin/custom-background.php	(revision 22252)
+++ wp-admin/custom-background.php	(working copy)
@@ -358,8 +358,14 @@
 
 		check_admin_referer('custom-background-upload', '_wpnonce-custom-background-upload');
 		$overrides = array('test_form' => false);
-		$file = wp_handle_upload($_FILES['import'], $overrides);
 
+		$file = $_FILES['import'];
+		$wp_filetype = wp_check_filetype_and_ext( $file['tmp_name'], $file['name'], false );
+		if ( ! wp_match_mime_types( 'image', $wp_filetype['type'] ) )
+			wp_die( __( 'The uploaded file is not a valid image. Please try again.' ) );
+
+		$file = wp_handle_upload($file, $overrides);
+
 		if ( isset($file['error']) )
 			wp_die( $file['error'] );