There are so many CVEs related to upload… and basic user/group/file permissions and proper rules within the web proxy could mitigate them.
It reeks of people just writing stuff and tossing it up thinking that they’ve crafted something so great they needn’t worry. Get a good platform team.