CVE-2018-9206

Unrestricted Upload of File with Dangerous Type in blueimp-file-upload

9.8 CriticalPublic exploitFix available

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

97.3%Up 61.4 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

Record: CVE-2018-9206
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-434
Updated: 2026-11-02

CVE List No score

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

Record: CVE-2018-9206
Updated: 2026-11-02

EUVDEUVD-2018-0499 No score

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

Record: EUVD-2018-0499
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4cj8-g9cp-v5wr 9.8

Unrestricted Upload of File with Dangerous Type in blueimp-file-upload

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

Record: GHSA-4cj8-g9cp-v5wr
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

OSV 9.8

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

Record: CVE-2018-9206
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-9206 9.8

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

Record: DEBIAN-CVE-2018-9206
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-4cj8-g9cp-v5wr 9.8

Unrestricted Upload of File with Dangerous Type in blueimp-file-upload

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

Record: GHSA-4cj8-g9cp-v5wr
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-9206 9.8

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

Record: UBUNTU-CVE-2018-9206
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`blueimp-file-upload` npm	through 9.22.0	9.22.1
`libjs-jquery-file-upload` Debian:12	before 9.25.0-1	9.25.0-1
`libjs-jquery-file-upload` Debian:13	before 9.25.0-1	9.25.0-1
`libjs-jquery-file-upload` Debian:14	before 9.25.0-1	9.25.0-1
`blueimp-file-upload` npm	before 9.22.1	9.22.1
`libjs-jquery-file-upload` Ubuntu:18.04:LTS	before 9.19.1-1ubuntu0.1, plus listed versions 9.19.1-1	9.19.1-1ubuntu0.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	jQuery-File-Upload 9.22.0 - Arbitrary File Upload	2018-10-11
Exploit-DB	blueimp's jQuery 9.22.0 - (Arbitrary) File Upload (Metasploit)	2018-11-06
Exploit-DB	Blueimp's jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit	2019-01-16
Metasploit	blueimp's jQuery (Arbitrary) File Upload	2018-10-09
Nuclei	Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload
PoC in GitHub	Den1al/CVE-2018-9206	2018-10-22
PoC in GitHub	Stahlz/JQShell	2018-10-24
PoC in GitHub	cved-sources/cve-2018-9206	2019-01-11
PoC in GitHub	flame-11/CVE-2018-9206-jquery-file-upload	2025-12-27
PoC in GitHub	liemkaka/CVE-2018-9206	2025-03-27
PoC in GitHub	mi-hood/CVE-2018-9206	2021-04-20

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-9206 is a critical vulnerability (CVSS 9.8) in Blueimp Jquery-file-upload, published October 11, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.3%, the 99th percentile. Fixed in blueimp-file-upload 9.22.1.

References

Show 10 moreShow less