Web Vulnerabilities
Web Root
Also: document root
The folder a web server publishes: files inside it can be fetched, and sometimes run, by anyone who can request them.
In more detail
Anything placed under the web root is reachable by URL. If a server also treats certain file types in that folder as programs to execute, then a file that arrives there from outside may run. Keeping uploads outside the web root, or in a folder with execution disabled, removes the route.