any filtering ? comprehensive ?
blacklist or whitelist ?
path issue (special characters in the path) ?
predictable upload path ?