The first step in many attacks is to get some code to the system to be attacked. Then the attack only needs to find a way to get the code executed. The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, client-side attacks, or simple defacement. To protect against this type of attack, you should analyse everything your application does with files and think carefully about what processing and interpreters are involved.”]
Source: https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload