The security danger of publicly exposing an upload field
Drupal places an .htaccess file in the files directory to prevent files inside from being executed. Check the status report on your site to ensure that this is correctly configured.