CVE-2018-9206: Blueimp jQuery-File-Upload unauthenticated arbitrary file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable arbitrary file upload with a 9.8 CVSS score, public exploit code and near-maximum EPSS probability.

What it is

Blueimp jQuery-File-Upload versions up to and including v9.22.0 contain an unrestricted file upload flaw (CWE-434) that can be triggered without authentication. Because uploaded files are not adequately restricted, an attacker can place executable content on the server, making this a critical issue for any deployment exposing the upload endpoint.

Impact

An attacker can upload arbitrary files, including server-side scripts, which typically leads to remote code execution and full compromise of the affected host or application.

Attack surface

Reached over the network via the file upload endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the description both indicate no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.97255, 99.892nd percentile) and multiple references are tagged Exploit, including Exploit-DB entries 45790 and 46182, so public exploit code exists.

What to do

• Upgrade Blueimp jQuery-File-Upload past v9.22.0 or apply the vendor patch; if the library is bundled in a CMS or product, apply that vendor's update (Oracle issued a patch advisory).
• Restrict the upload endpoint to authenticated users and enforce server-side allowlists for file type, extension and content.
• Store uploaded files outside the web root and serve them without execute permissions.
• Deploy WAF rules to block uploads of script extensions and monitor the upload path for anomalous POST requests.
• If the component is unused, remove or disable it entirely.

Detection

• Monitor web server and application logs for POST requests to jQuery-File-Upload endpoints followed by requests to newly written files.
• Alert on files created in web-accessible directories with executable extensions (php, jsp, asp, aspx, py, sh).
• Hunt for known exploit payload patterns and user-agent strings associated with public Exploit-DB PoCs for this CVE.
• Baseline normal upload volume and flag spikes or uploads from unauthenticated sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.