Fascinating, that has been the attack vector in a couple of hackthebox like systems I've done over the last couple of years. The easier ones usually just require file name changes, the medium ones intercepting and mimetype change.