GovTech interview question

How do file upload attacks work?