Arbitrary File Upload Vulnerability (RESTful API of the Upload Plugin)
### Node Version

18.x

### NPM/Yarn/PNPM Version

10.x

### Strapi Version

4.x

### Operating System

Linux (Debian/Ubuntu)

### Database

MariaDB

### Javascript or Typescript

Javascript

### Reproduction URL

_No response_

### Bug Description

Dear Strapi Team,

I would like to report a security vulnerability affecting all versions of Strapi, specifically within the RESTful API of the Upload plugin. This vulnerability can be exploited by attackers to upload malicious files, potentially leading to legal risks. The details are as follows:

Vulnerability Description:

Vulnerability Type: Arbitrary file upload (HTML file upload bypass)
Vulnerability Location: RESTful API of the Upload plugin
Affects Versions: All versions
Steps to Reproduce:
An attacker successfully uploads an HTML file containing malicious JavaScript code via the Upload plugin's RESTful API.
The HTML file triggers a JavaScript redirect to a website that does not comply with local laws.
The malicious file is stored on the server, allowing the attacker to use the legitimate domain to provide illegal content, causing significant legal issues for the company.
Potential Risks:

Attackers can upload and execute malicious HTML files, using JavaScript redirects to direct users to illegal websites.
This behavior could expose the company to legal liability as the attacker uses the legitimate domain to promote illegal content, damaging the company's reputation and compliance.
Suggested Fix:

It is strongly recommended that Strapi provides a file type restriction configuration within the Upload plugin, allowing users to specify which file types are allowed for upload, with a particular focus on restricting HTML files.
Strengthen content checks for uploaded files, especially for those containing JavaScript code, to prevent malicious redirection attacks.
Implement stricter file path and permission controls to ensure uploaded files cannot be executed.
This vulnerability exists in all versions and could have serious consequences for both companies and the community. I strongly urge a prompt fix. If further details or assistance are needed, I am happy to provide more information.

Thank you for the valuable contributions Strapi has made to the open-source community. I look forward to your response.

Best regards,
LELE
ybzc.gg@gmail.com

### Steps to Reproduce

by upload rest api

### Expected Behavior

I hope users can customize the file types allowed to be uploaded

### Logs

```shell

```

### Code Snippets

_No response_

### Media

_No response_

### Additional information

_No response_

### Confirmation Checklist

- [x] I have checked the existing [issues](https://github.com/strapi/strapi/issues) for duplicates.
- [x] I agree to follow this project's [Code of Conduct](https://github.com/strapi/strapi/blob/develop/CODE_OF_CONDUCT.md).