A transit portal stores user uploads under a web-accessible directory where the server will execute matching scripts. Why is this combination a critical finding class?
Select an answer to reveal the explanation.
Short Explanation
Leaving a loaded tool on a public shelf is different from locking it in a vault. Uploads that sit in an executable webroot can be fetched and run like pages. That location-plus-execution combo is why upload findings go critical fast.
Full Explanation
Upload risk is not only about file content; storage location and execution policy matter. Files written beneath a document root that executes scripts can yield remote code execution if validation fails. Safer designs store uploads outside the webroot, serve them through controlled handlers, and disable execution on upload trees. XSS-in-PDF or TLS myths do not capture this architectural failure.