upload_files is a WordPress capability that allows a user role to upload files to the media library. It is one of the permissions that controls who can add images, documents, and other attachments through normal site workflows.
This capability matters because uploads are often the start of a security chain. Attackers who obtain a valid account with upload_files may be able to place malicious content on the server, especially if uploaded files are later processed by image or document tools. Defenders should grant this permission only to roles that truly need it, review who can upload media, and treat file-handling paths as trusted code paths that need validation, isolation, and monitoring.