Q:

Can a file upload function be vulnerable without it the file name getting passed?

From googling, a lot of file upload vulnerabilities rely on injecting something into the filename and also rely on the picture being stored on the server, is it safe to just do a post request of the picture's content (file-contents: ‰PNG...... via post request) then display it on the browser like, as <img src="data:image/png;base64,.....> ?

A:

Most definitely!
File uploads can be very tricky and there is a lot that can go wrong.  There are (at least) two further steps you should take:
1. Verify that the file is actually a PNG
If you are expecting only PNGs, then you should verify that the file is actually a PNG.  To be clear, checking the extension is useless here - you want to check the actual file contents themselves.  If you don't do this you open yourself up to a few potential attacks of varying levels of severity:

An attacker can upload a JS file.  This can help as part of a multi-step attack by bypassing a CSP or other restrictions.
An attacker could host their own HTML files/images/an entire website on your website, potentially making phishing or other attacks much, much easier.
Depending on your server setup, an attacker may be able to upload scripts and have your server execute them, compromising your system.

2. Make sure the file cannot be executed by the server
Even if you check to verify that the file is a valid PNG, this may not be enough to stop an attacker from using your file upload to upload and execute scripts.  In particular, most image formats allow for comments and meta data in headers.  It is possible to put actual code in these comments, and in the event of permissively configured servers, the attacker may be able to trick the server into executing it.  Most modern servers with default configurations will be immune to such attacks, but attacks like this are possible and definitely have happened.
Bonus: Host somewhere else
The most straight-forward way of mitigating the above attacks is by hosting your uploaded files elsewhere.  Most modern cloud providers have buckets that are a perfect use case for this (AWS, GCP, Azure), but you can always manage it yourself with a separate server on a different domain that only serves static files.  By hosting the uploaded files on a different domain you skip the risk of CSP bypass, and by hosting it on a server that is incapable of treating files as code, you don't have to worry about missed vectors for RCE.  In essence, by immediately transferring uploaded files to a separate system, you're putting them in a sandbox for safety.

