Validate it's really a pdf (eg it's not an EXE or JS etc). Do this via multiple methods such as file extension but also using magic text.
Antivirus solutions have command line or codeable scan checkers so AV scan the pdf before deciding to permanently store it on your system.
Log everything so you know who uploaded a pdf and who viewed it
Have a process in place to quickly remove a Malicious process from the system if one is found