Exploit: XSS filename injection in Dropzone.js

https://stackoverflow.com/questions/39858211/security-how-to-prevent-xss-filename-injection-in-dropzone-js

Web server must be using Linux

In dropzone.js extension, it’s possible with a Linux system to rename a legit filename and execute it with special characters like :

"><svg onload=alert(1)>.jpg

"><img src=x onerror=prompt(document.domain)>.png