What vulnerabilities exist that allow uploading a file via FTP to a server?

Question

Burglary protection

Infected files and purely virus files (new ones that should not be there) appeared on the server. Including files with php forms, through which, apparently, all other files are uploaded to the server. Tell me what vulnerabilities can be used to download data via FTP. After all, they had to somehow upload their first file there.

Suspicion falls on one landing page, which is completely made in HTML (index.html) - there are a couple of text blocks and a form; there is no possibility to upload files on the form - there are only 3 fields. On the server side, the fields are processed via 'htmlspecialchars'. Is it possible to upload a file to the server through this form?