File Upload Vulnerabilities

How a simple "upload your avatar" feature turns into webshell RCE. Every angle: extension/MIME/magic-byte bypasses, polyglot files…