Description
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Blueimp | Blueimp jQuery-File-Upload | unspecified – ≤ 9.22.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libjs-jquery-file-upload | 9.25.0-1 | — |
| Debian 13 | libjs-jquery-file-upload | 9.25.0-1 | — |
| Debian 12 | libjs-jquery-file-upload | 9.25.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libjs-jquery-file-upload | 9.19.1-1ubuntu0.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
blueimp's jQuery (Arbitrary) File Upload
exploit/unix/webapp/jquery_file_upload
Exploit-DB 3
- Blueimp's jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit EDB-46182 · webapps · Jan 16, 2019
- blueimp's jQuery 9.22.0 - (Arbitrary) File Upload (Metasploit) EDB-45790 · remote · Nov 6, 2018 · verified
- jQuery-File-Upload 9.22.0 - Arbitrary File Upload EDB-45584 · webapps · Oct 11, 2018 · verified
GitHub 6 repositories
-
Stahlz/JQShell ★ 62 · Oct 24, 2018
A weaponized version of CVE-2018-9206
-
Den1al/CVE-2018-9206 ★ 13 · Oct 22, 2018
A Python PoC for CVE-2018-9206
-
flame-11/CVE-2018-9206-jquery-file-upload ★ 1 · Dec 27, 2025
-
liemkaka/CVE-2018-9206 ★ 0 · Mar 27, 2025
-
mi-hood/CVE-2018-9206 ★ 0 · Apr 20, 2021
jquery file upload poc
-
cved-sources/cve-2018-9206 ★ 0 · Jan 11, 2019
cve-2018-9206
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload http/cves/2018/CVE-2018-9206.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | blueimp-file-upload | < 9.22.1 | 9.22.1 | GHSA-4cj8-g9cp-v5wr |
Advisories 1
- WID-SEC-2023-3032 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 4, 2023