I'm investigating the same. The upload endpoint uses secure_filename to get the filename used in that func. I'm not familiar with it, but the docs say it could return an empty string.