1. Try to upload a file and execute/open it on the server.
2. Try to over­write a file on the serv­er if you can change the tar­get path in the request.
3. Try to make invalid requests to pro­voke error messages.
4. Try to add some tem­plate lan­guage which could print/execute something.

(!) If upload does not seem to work, change the suf­fix e.g. from .php to .pHp.

More:

• Try a ZIP bomb
• Try a Zip­slip file
• https://www.onsecurity.io/blog/file-upload-checklist/

File uploads / images

1. Upload a valid image file to see how it works.
2. Upload a sim­ple invalid file like a text file.

• Try https://github.com/chinarulezzz/pixload
• Think about Image­Trag­ick
• Flask/Jinja/OCR? Try to upload an image which could be interpretet: 
  • convert -background "#ffffff" -size 600x100 -fill "#000000" -gravity center label:"{{ self }}" a7.png