Web Vulnerabilities
Unrestricted File Upload
Also: dangerous file upload, CWE-434
A flaw where a site accepts an uploaded file without limiting its type, name or destination, so the file is used in a harmful way.
In more detail
The danger is rarely the file's bytes alone. It is where the file lands and how the server treats it: an uploaded script stored in a folder the web server executes, or a name containing path segments that writes it somewhere sensitive. Defenses include a strict allowlist, server-chosen names, storage outside the web root, and no execution rights on the upload folder.