diff --git a/config.toml b/config.toml
index bd7c2e4..5f57b77 100644
--- a/config.toml
+++ b/config.toml
@@ -17,3 +17,8 @@ mime_override = [
     { mime = "application/octet-stream", regex = "^.*\\.bin$" },
     { mime = "text/plain", regex = "^.*\\.(log|txt|diff)$" },
 ]
+mime_blacklist = [
+    "application/x-dosexec",
+    "application/java-archive",
+    "application/java-vm"
+]
diff --git a/src/config.rs b/src/config.rs
index 5612a7a..dfab964 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -35,6 +35,8 @@ pub struct PasteConfig {
     pub default_extension: String,
     /// Media type override options.
     pub mime_override: Vec<MimeMatcher>,
+    /// Media type blacklist.
+    pub mime_blacklist: Vec<String>,
 }
 
 impl Config {
diff --git a/src/paste.rs b/src/paste.rs
index c745d4b..3ab5fce 100644
--- a/src/paste.rs
+++ b/src/paste.rs
@@ -48,6 +48,17 @@ impl Paste {
     /// [`default_extension`]: crate::config::PasteConfig::default_extension
     /// [`random_url.enabled`]: crate::random::RandomURLConfig::enabled
     pub fn store_file(&self, file_name: &str, config: &Config) -> IoResult<String> {
+        let file_type = infer::get(&self.data);
+        if let Some(file_type) = file_type {
+            for mime_type in &config.paste.mime_blacklist {
+                if mime_type == file_type.mime_type() {
+                    return Err(IoError::new(
+                        IoErrorKind::Other,
+                        String::from("this file type is not permitted"),
+                    ));
+                }
+            }
+        }
         let file_name = match PathBuf::from(file_name)
             .file_name()
             .map(|v| v.to_str())
@@ -70,7 +81,7 @@ impl Paste {
                     path.set_file_name(file_name);
                 }
                 path.set_extension(
-                    infer::get(&self.data)
+                    file_type
                         .map(|t| t.extension())
                         .unwrap_or(&config.paste.default_extension),
                 );