CVE-2018-9206 Unrestricted Upload of File with Dangerous Type in blueimp-file-upload
Unauthenticated attackers can upload arbitrary files to execute code on systems using the vulnerable jQuery File Upload library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-9206?
CVE-2018-9206 is a critical vulnerability in Blueimp jQuery-File-Upload, published on 11 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
Weakness: CWE-434
Which versions are affected by CVE-2018-9206?
2 open source packages ship an affected version, including blueimp-file-upload. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
blueimp-file-upload npm | All versions | 9.22.1 |
blueimp-file-upload npm | All versions | 9.22.1 |
Products include Jquery File Upload Project Jquery File Upload.
How do I fix CVE-2018-9206?
Upgrade blueimp-file-upload to 9.22.1 or later.
Is CVE-2018-9206 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-9206 exists.
Public exploit code: 1 Metasploit module, 4 Exploit-DB entries, 1 Nuclei template and 6 proofs of concept on GitHub.
Sources
Also known as CVE-2025-63994, DEBIAN-CVE-2018-9206, GHSA-4cj8-g9cp-v5wr, UBUNTU-CVE-2018-9206.