Cross-Site Scripting Through Upload Forms

If a webpage doesn't change the name of the file you upload, you may be able to get XSS from it. Consider the context in which this is executing however, as it may end up just being self-XSS.