For an attacker this is a 2 step process 1 - upload malicious file 2 - execute it
So if they already have an input=file opportunity to get the file onto the system then it's all about step 2.
The attacker has multiple options such as - RCE (remote code execution) vulnerability, they then execute it themself - Social Engineer or wait for a user on the system to execute it (for example if they're uploading a resume , they wait for the HR staff to open it) - If it's a web server , they upload a webshell, then make a web request through a browser to that newly uploaded page/shell ... causing the web server itself to execute it
After successful upload whenever the file is visited/opened from back-end side it may executes and gives response to us. Instead of alert message we can include our XSS hunter payload in src=