`StudentDocumentsController.Upload` enforces a 50MB size limit but accepts any file type/extension. Downloads do set an explicit attachment filename/content-type rather than rendering inline, which limits impact, but nothing currently stops arbitrary file types from being stored.
Fix: add a content-type/extension allowlist (and/or AV scan) on upload.
Found during the Aug 2026 security sweep.
`StudentDocumentsController.Upload` enforces a 50MB size limit but accepts any file type/extension. Downloads do set an explicit attachment filename/content-type rather than rendering inline, which limits impact, but nothing currently stops arbitrary file types from being stored.
Fix: add a content-type/extension allowlist (and/or AV scan) on upload.
Found during the Aug 2026 security sweep.