Of course - there is still the possibility that an uploaded script can be executed by the framework, but at least it requires an exploit to do the upload and an

Of course - there is still the possibility that an uploaded script can be executed by the framework, but at least it requires an exploit to do the upload and another one to make your application execute it. If arbitrary php files can be executed, they only need to be able to upload them.