Special:Upload gives

This file contains HTML or script code that may be erroneously interpreted by a web browser. See the FAQ for more information.

So I guess the error is that UW does not show the same message? What is the exact error message you get?

Error message is:

"This file might be corrupt, or have the wrong extension."

Also, are we seriously blocking JPEG uploads because there might be HTML in some EXIF field?

In T105224#1442527, @Magnus wrote:

Also, are we seriously blocking JPEG uploads because there might be HTML in some EXIF field?

Yes; it's an XSS vector on IE6/7 whose content sniffing can be tripped by anything that looks remotely like HTML. (See the IEContentAnalyzer class. Tim reverse-engineered that from IE executables; pretty awesome stuff.)

In T105224#1442519, @Magnus wrote:

Error message is:

"This file might be corrupt, or have the wrong extension."

That comes from the API (api-error-verification-error), so useful error information is dropped somewhere on the server side.

The reason is already included in the 'details' element of the error response:

{
   "servedby" : "unknown"
   "code" : "verification-error",
   "error" : "This file did not pass file verification",
   "details" : [
      "uploadscripted"
   ],
   "*" : "See http://localhost/w/api.php for API usage",
}

Right now, we could adjust the API to replace or append the default English message (i.e. $this->msg( ... )->inLanguage( 'en' )->useDatabase( false )->text(), in this case "This file contains HTML or script code that may be erroneously interpreted by a web browser.") to the 'error' element. Anything more than that would be blocked by T47843.

Change 224067 had a related patch set uploaded (by Anomie):
API: Improve upload error reporting

https://gerrit.wikimedia.org/r/224067

Change 224067 merged by jenkins-bot:
API: Improve upload error reporting

https://gerrit.wikimedia.org/r/224067

Thanks @Anomie!

UploadWizard still does not display the error message; IIRC that's T77823.