File uploads are the most abused input on any system, a place where users hand you arbitrary bytes and you store them. The mistakes are consistent: trusting the extension, skipping size limits, storing files where the web server can execute them.
The baseline: check the actual file type, not the extension. Cap the size. Store uploads outside the web root or in a bucket, served through a handler, never as directly executable files.
And scan what you can. An uploaded PDF that isn't a PDF is a problem you want to catch at the door, not after it's served to the next user.
