The 3 file-detect modules mentioned already: File::Type, MIME::Detect, File::MMagic all report an xlsx file as application/zip because it really is a zip file as choroba wrote.

The catch is that even if your uploaded file is a zip file, it is not necessarily an xlsx. So, you will probably have to extract the list of files from the archive and check whether certain files any xlsx document should contain are present. I am not sure if there is a method 100% accurate to do that (detection I mean) due to possible exceptions unless you feed it to M$. In fact I do not know if xlsx file format is officially public knowledge or one has to reverse engineer it.

If you want to go light and moduleless the file signature of an xlsx file I created with LibreOffice at a linux/intel box using hexdump is 4b50 0403 0014 0808 which is comparable - bar endianess - to, say, info from https://www.garykessler.net/library/file_sigs.html.

Then, even detecting a csv file can be tricky, if it contains unicode. You can't even count on the abundance of commas it should normally contain because they may be encoded in unicode as fancy counter-clockwise commas :) they do that with inverted commas and even gcc spits out unicode nowadays.