Yes... the upload happens during the form submit before any server code runs, so you can't really stop the file from being uploaded. You could delete the uploaded file when it fails server validation, or you could add client side validation before the file is uploaded.