any file upload vulnerability

[weathon]

solution: check file is pic before submit
想到化学作业下载可以从api上传没有检查