File upload with validation