Every upload is virus-scanned
Each file is scanned by ClamAV. In production, if the scan can't run, the upload is rejected (fail-closed). Executables and scripts are blocked by extension, and HTML/SVG by MIME sniffing, to cut off disguised-file attacks.
