Do filenames themselves pose a security risk?
We have a webserver, users can upload files to the server. The files are temporarily stored on the server, then moved to S3. The filenames are recorded into our MySQL database and eventually included in the HTML & CSS that our webserver produces. The filenames themselves are never changed from what the user uploads.
In terms of security, is there any vulnerability that can be exploited with a mere filename? Should we be changing the filenames of uploaded content, or is it safe to simply store the filenames as they are?