diff --git a/src/vaadin-upload.html b/src/vaadin-upload.html
index ee58fd6..0eb9689 100644
--- a/src/vaadin-upload.html
+++ b/src/vaadin-upload.html
@@ -754,7 +754,10 @@
             return;
           }
           const fileExt = file.name.match(/\.[^\.]*$|$/)[0];
-          const re = new RegExp('^(' + this.accept.replace(/[, ]+/g, '|').replace(/\/\*/g, '/.*') + ')$', 'i');
+          // Escape regex operators common to mime types
+          const escapedAccept = this.accept.replace(/[+.]/g, '\\$&');
+          // Create accept regex that can match comma separated patterns, star (*) wildcards
+          const re = new RegExp(`^(${escapedAccept.replace(/[, ]+/g, '|').replace(/\/\*/g, '/.*')})$`, 'i');
           if (this.accept && !(re.test(file.type) || re.test(fileExt))) {
             this.dispatchEvent(
               new CustomEvent('file-reject', {