PHP : Unsafe file upload

The application receives a file attached to a SOAP-message. This can be exploited to upload malicious data or code to the server.

If users can upload files to a publicly accessible directory, an attacker can use this for remote execution of malicious code on the server.