The security danger of publicly exposing an upload field On older drupal 7 websites I once faced security patches for the webform module, because file upload fields were considered insecure. There was en exploit where people could end up uploading .html files (via ajax) to your files storage and started spamming to those links.

I'm currently working on a drupal 8 project where anonymous users can fill in a form and upload their resume in a file field. I chose to create a content type and a custom form mode. Now the form is shown in a custom controller on the site.

My questions:


How (un)safe is the public exposure of a file upload field?
Are you aware of any steps taken in drupal 8 to further secure this?
Any suggestions to do this even more securely? 


Thanks in advance.
Drupal places an .htaccess file in the files directory to prevent files inside from being executed. Check the status report on your site to ensure that this is correctly configured.