You're correct. 'Arbitrary file upload' is more applicable.