diff --git a/lib/Controller/ViewerController.php b/lib/Controller/ViewerController.php
index b515097..b68be1c 100644
--- a/lib/Controller/ViewerController.php
+++ b/lib/Controller/ViewerController.php
@@ -52,6 +52,10 @@ use Symfony\Component\EventDispatcher\GenericEvent;
 
 class ViewerController extends Controller {
 
+	const PDF_MIME_TYPES = [
+		'application/pdf',
+	];
+
 	/** @var string */
 	private $userId;
 
@@ -262,6 +266,18 @@ class ViewerController extends Controller {
 		return $fileUrl;
 	}
 
+	private function isValidPdfFile($file) {
+		$mime = $file->getMimeType();
+		if ($mime) {
+			$mime = strtolower($mime);
+		}
+		if (!in_array($mime, self::PDF_MIME_TYPES)) {
+			return $this->l10n->t('File %s is not a PDF file (%s)', [$file->getName(), $mime]);
+		}
+
+		return null;
+	}
+
 	/**
 	 * @NoAdminRequired
 	 * @NoCSRFRequired
@@ -282,6 +298,12 @@ class ViewerController extends Controller {
 			return ['error' => $error];
 		}
 
+		$error = $this->isValidPdfFile($file);
+		if (isset($error)) {
+			$this->logger->error("index: " . $fileId . " " . $error, array("app" => $this->appName));
+			return ['error' => $error];
+		}
+
 		$backend = $this->config->getAppValue('pdfdraw', 'backend');
 		if (!empty($backend)) {
 			$backend = json_decode($backend);
@@ -329,6 +351,12 @@ class ViewerController extends Controller {
 			return ['error' => $error];
 		}
 
+		$error = $this->isValidPdfFile($file);
+		if (isset($error)) {
+			$this->logger->error("viewer: " . $fileId . " " . $error, array("app" => $this->appName));
+			return ['error' => $error];
+		}
+
 		if (!empty($token)) {
 			list ($share, $error) = $this->getShare($token);
 			if (isset($error)) {