What creates a dangerous web file-upload vulnerability?
The application checks an explicit list of permitted extensions.
The application checks and reports upload errors.
The application limits uploads to small files.
The application accepts and stores uploaded files without adequately validating what they are and how they can be used.