FileUpload filenames with client-controlled extensions can be used for XSS

The FileUpload component generated random storage filenames by combining a ULID with the extension from the client-provided filename. File type validation uses the file's detected MIME type, so a file accepted as an image could still be stored with an active extension such as .html. The Spatie media library rich editor attachment provider used the same naming behavior.

If uploads are stored on a public disk and served from the application's origin with a content type based on the filename extension, an authenticated uploader could upload a polyglot file that executes JavaScript when another user opens its URL. This issue does not require preserveFilenames() or a custom filename callback. Those explicit options continue to accept user-controlled filenames and should only be used with trusted users.