AIKIDO-2026-470568

TL;DR

Freeform's File Upload Drag & Drop field lets an unauthenticated visitor with access to a public form bypass the field's configured file type and file size restrictions. The traditional upload endpoint skips page validation when the request includes a form_previous_page_button parameter, so the field records no errors even though its checks never ran, and the shared upload service stores the file without enforcing those restrictions itself. The headless drag and drop upload endpoint reaches the same unguarded upload service. The fix makes the upload service enforce the field's file type and file size restrictions before storing the file.