Another potential hack is less obvious, but it's severity can not be understated. The HTTP multipart/form-data protocols include a convention that allows the client (typically a browser) to include the filename of the source of the data that is being sent to the application server. This feature can be very helpful, since it permits clients and the application the opportunity for the client and application to use a recognizable name to reference client data within the application. While a browser will likely strip all directory references from this client filename, a nefarious client may execute malicious code to create multipart form-data with filenames that attempt to overwrite system/application files within the application server. Applications that attempt to use the client supplied suggested filename must always check to ensure that client supplied filenames do not contain a hostile directory specification.
The code below is overly simplific, applications will likely want to include a bit more logic for added security and organization.