tl:dr is that the configuration you're suggesting will leave a site open to arbitrary code execution if the site allows for user uploads.