If the files are upload only and there is no way to execute them then this is not a high risk vulnerability. It is good practice to also set the Content-Disposition header, as this will force a download and prevent XSS vulnerabilities if HTML or SVG is uploaded. See here for a demo (click
this HTML in the second paragraph).
However, being able to upload malware to a system is never a good thing.
App_Data folder is being suggested as this isn't readable through an ASP.NET serving IIS server.
example.com/App_Data/virus.bat will return an HTTP 403 Forbidden. Therefore it is a good place to store files as they are not directly publically executable or viewable.
To mitigate the malware threat to server administrators and those with access to the file system, you should virus scan all uploaded files and only allow a whitelist of safe extensions to be uploaded. e.g.
.txt, .gif, .jpg. Do not rely on MIME types if the files are saved with the original names as the target system will take extension to determine how to handle them.
Blacklisting is difficult due to the number of executable extensions, which is always changing as new file types are designed.
Another vulnerability that may affect availability or integrity of the application is if other users can overwrite already existing files. Ensure that this is not the case and users cannot do anything malicious using this vector.
Also you should ensure a user cannot upload a file called
..\index.aspx or the like to cause your system to write the file somewhere else other than intended. This is known as directory traversal and some other possible character sequences are here.
Finally, for more info check out OWASP.