Webforms - Is it safe to allow users to upload attachments?
Here is a security advisory from drupal.org that explains some of the dangers of letting anonymous users upload files: https://www.drupal.org/psa-2016-003

tl;dr


Configure upload fields that non-trusted visitors, including
anonymous visitors, can upload files with, to utilize use the private
file system.
Consider forcing users to create accounts before
submitting content. 
Audit your public file space to make sure that
files that are uploaded there are valid.