Since this is about vulnerabilities in a third-party dependency (ImageMagick/Ghostscript), the recommendation in the blog post to use the GD library instead (what the image_library 0 setting does) is not very sound, as libgd also had a number of vulnerabilities in the past, albeit less than ImageMagick:
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Libgd
A better recommendation is to securely configure ImageMagick, or even better: to use a safer image processing library (e.g libvips or imageflow).
I’ve added some mitigating code and recommendations on how to securely configure ImageMagick to jQuery File Upload, please have a look here:
https://github.com/blueimp/jQuery-File-Upload/blob/master/VU...
https://github.com/blueimp/jQuery-File-Upload/blob/master/SE...
In Zero-day in jQuery plugin sample code exploited for at least three yearsblueimp
jQuery-File-Upload
PHP2011–2018
blueimp / jQuery-File-Upload · Archived
jQuery-File-Upload
File Upload widget with multiple file selection, drag&drop support, progress bar, validation and preview images, audio and video for jQuery. Supports cross-domain, chunked and resumable file uploads. Works with any server-side platform (Google App Engine, PHP, Python, Ruby on Rails, Java, etc.) that supports standard HTML form file uploads.
13Distinct people
20Mentions
0Explicit recommenders
30.7KGitHub stars
What to know before exploring
What it is
File Upload widget with multiple file selection, drag&drop support, progress bar, validation and preview images, audio and video for jQuery. Supports cross-domain, chunked and resumable file uploads. Works with any server-side platform (Google App Engine, PHP, Python, Ruby on Rails, Java, etc.) that supports standard HTML form file uploads.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 2:17:07 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year20 dated mentions
Observed mentions: 2011-01-22 21:18:32 UTC to 2018-10-27 07:13:47 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2011 | 2011-01-01 00:00:00 UTC | 2012-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 9 | 0 | 9 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
jQuery File Upload
Contents
Description
Demo
Features
Security
Setup
Requirements
Mandatory requirements
Optional requirements
Cross-domain requirements
Browsers
Desktop browsers
Mobile browsers
Extended browser support information
Testing
Support
License
Description
File Upload widget with multiple file selection, drag&drop support, progress
bars, validation and preview images, audio and video for jQuery.
Supports cross-domain, chunked and resumable file uploads and client-side
image resizing.
Works with any server-side platform (PHP, Python, Ruby on Rails, Java,
Node.js, Go etc.) that supports standard HTML form file uploads.
Demo
Demo File Upload
Features
Multiple file upload:
Allows to select multiple files at once and upload them simultaneously.
Drag & Drop support:
Allows to upload files by dragging them from your desktop or file manager and
dropping them on your browser window.
Upload progress bar:
Shows a progress bar indicating the upload progress for individual files and
for all uploads combined.
Cancelable uploads:
Individual file uploads can be canceled to stop the upload progress.
Resumable uploads:
Aborted uploads can be resumed with browsers supporting the Blob API.
Chunked uploads:
Large files can be uploaded in smaller chunks with browsers supporting the
Blob API.
Client-side image resizing:
Images can be automatically resized on client-side with browsers supporting
the required JS APIs.
Preview images, audio and video:
A preview of image, audio and video files can be displayed before uploading
with browsers supporting the required APIs.
No browser plugins (e.g. Adobe Flash) required:
The implementation is based on open standards like HTML5 and JavaScript and
requires no additional browser plugins.
Graceful fallback for legacy browsers:
Uploads files via XMLHttpRequests if supported and uses iframes as fallback
for legacy browsers.
HTML file upload form fallback:
Allows progressive enhancement by using a standard HTML file upload form as
widget element.
Cross-site file uploads:
Supports uploading files to a different domain with cross-site XMLHttpRequests
or iframe redirects.
Multiple plugin instances:
Allows to use multiple plugin instances on the same webpage.
Customizable and extensible:
Provides an API to set individual options and define callback methods for
various upload events.
Multipart and file contents stream uploads:
Files can be uploaded as standard "multipart/form-data" or file contents
stream (HTTP PUT file upload).
Compatible with any server-side application platform:
Works with any server-side platform (PHP, Python, Ruby on Rails, Java,
Node.js, Go etc.) that supports standard HTML form file uploads.
Security
⚠️ Please read the VULNERABILITIES document for a list of
fixed vulnerabilities
Please also read the SECURITY document for instructions on how to
securely configure your Web server for file uploads.
Setup
jQuery File Upload can be installed via NPM:
npm install blueimp-file-upload
This allows you to include jquery.fileupload.js and
its extensions via node_modules, e.g:
<script src="node_modules/blueimp-file-upload/js/jquery.fileupload.js"></script>
The widget can then be initialized on a file upload form the following way:
$('#fileupload').fileupload();
For further information, please refer to the following guides:
Main documentation page
List of all available Options
The plugin API
How to setup the plugin on your website
How to use only the basic plugin.
Requirements
Mandatory requirements
jQuery v1.7+
jQuery UI widget factory v1.9+
(included): Required for the basic File Upload plugin, but very lightweight
without any other dependencies from the jQuery UI suite.
jQuery Iframe Transport plugin
(included): Required for
browsers without XHR file upload support.
Optional requirements
JavaScript Templates engine
v3+: Used to render the selected and uploaded files.
JavaScript Load Image library
v2+: Required for the image previews and resizing functionality.
JavaScript Canvas to Blob polyfill
v3+:Required for the resizing functionality.
blueimp Gallery v2+: Used to display the
uploaded images in a lightbox.
Bootstrap v3+: Used for the demo design.
Glyphicons Icon set used by Bootstrap.
Cross-domain requirements
Cross-domain File Uploads
using the
Iframe Transport plugin
require a redirect back to the origin server to retrieve the upload results. The
example implementation
makes use of
result.html
as a static redirect page for the origin server.
The repository also includes the
jQuery XDomainRequest Transport plugin,
which enables limited cross-domain AJAX requests in Microsoft Internet Explorer
8 and 9 (IE 10 supports cross-domain XHR requests).
The XDomainRequest object allows GET and POST requests only and doesn't support
file uploads. It is used on the
Demo to delete uploaded files
from the cross-domain demo file upload service.
Browsers
Desktop browsers
The File Upload plugin is regularly tested with the latest browser versions and
supports the following minimal versions:
Google Chrome
Apple Safari 4.0+
Mozilla Firefox 3.0+
Opera 11.0+
Microsoft Internet Explorer 6.0+
Mobile browsers
The File Upload plugin has been tested with and supports the following mobile
browsers:
Apple Safari on iOS 6.0+
Google Chrome on iOS 6.0+
Google Chrome on Android 4.0+
Default Browser on Android 2.3+
Opera Mobile 12.0+
Extended browser support information
For a detailed overview of the features supported by each browser version and
known operating system / browser bugs, please have a look at the
Extended browser support information.
Testing
The project comes with three sets of tests:
Code linting using ESLint.
Unit tests using Mocha.
End-to-end tests using blueimp/wdio.
To run the tests, follow these steps:
Start Docker.
Install development dependencies:
npm install
Run the tests:
npm test
Support
This project is actively maintained, but there is no official support channel.
If you have a question that another developer m
Read the full README on GitHubWhat Hacker News says
9 sourcesIf the upload directory is securely configured, no.
Please refer to the vulnerability documentation here to see if you are affected: https://github.com/blueimp/jQuery-File-Upload/blob/master/VU...
In Zero-day in jQuery plugin sample code exploited for at least three yearsPlease refer to the vulnerability documentation here to see if you are affected: https://github.com/blueimp/jQuery-File-Upload/blob/master/VU...
In Zero-day in jQuery plugin sample code exploited for at least three yearsThanks!
I already got a helpful pull request for the main README.me that I've updated by now with
- Security-related releases on top of the main page: https://github.com/blueimp/jQuery-File-Upload#%EF%B8%8F-secu...
- Security guidelines linked in various places on how to securely set up file uploads: https://github.com/blueimp/jQuery-File-Upload/blob/master/SE...
- A list of the fixed vulnerabilities with instructions on how to fix it for the recent critical one: https://github.com/blueimp/jQuery-File-Upload/blob/master/VU...
The demo code was fixed as soon as I could confirm the report from Larry Cashdollar.
In Zero-day in jQuery plugin sample code exploited for at least three yearsThanks a lot!
By now I've also updated the project page with
- Security-related releases on top of the main page: https://github.com/blueimp/jQuery-File-Upload#%EF%B8%8F-secu...
- Security guidelines linked in various places on how to securely set up file uploads: https://github.com/blueimp/jQuery-File-Upload/blob/master/SE...
- A list of the fixed vulnerabilities with instructions on how to fix it for the recent critical one: https://github.com/blueimp/jQuery-File-Upload/blob/master/VU...
In Zero-day in jQuery plugin sample code exploited for at least three yearsUnfortunately, I never tested it with an Apache configuration that had .htaccess support disabled and so it simply did not occur to me that the default was "off".
I think the bigger issue was that the PHP sample code allowed all file types by default - this would not only affect Apache, but any Webserver that had broad rules to execute PHP scripts found in a directory.
Originally I didn't see this as an issue as I trusted developers to securely configure their server to make sure no uploaded files would be executed, which is why the .htaccess security settings were only added later in this commit: https://github.com/blueimp/jQuery-File-Upload/commit/13931c7...
But neither was the documentation informing developers clearly enough about the security implications, nor should I have relied on people actually reading security notices.
In Zero-day in jQuery plugin sample code exploited for at least three yearsAuthor of jQuery File Upload here.
The vulnerability is a combination of Apache v.2.3.9's default setting to not read .htaccess files and my mistake of relying on .htaccess to enforce security of the sample PHP upload component.
To give you some context on how this could happen:
- As the project name implies, this started as a client-side jQuery plugin, with a dummy PHP script to echo out the uploaded file
- Over time, I added a couple of sample server-side upload components, including two for Google App Engine (Python + Golang) - which I used for the demo - and one for PHP, which I never used myself in production
- I used the PHP component for local tests with various possible file uploads, including very large files and chunked uploads, which required enabling all file types for upload. My thinking was that allowing all file types for u
Read the rest
pload is not critical as long as the handling of those files is properly configured.
- Prior to adding the .htaccess file, I mistakenly assumed developers would configure their Apache server themselves so that no PHP scripts would be executed in the uploads folder. It was only added in this commit: https://github.com/blueimp/jQuery-File-Upload/commit/13931c7...
- The Apache servers I tested with always had support for .htaccess enabled, so I never bothered to check that the default Apache configuration since version 2.3.9 actually disabled it
- The original .htaccess configuration didn't even prevent script execution in all Apache configurations and had to be fixed, see: https://github.com/blueimp/jQuery-File-Upload/pull/3381
Looking back, there are a couple of things that I should have done differently:
- Move out the server-side components into separate repositories
- Inform users better about file upload security - see https://github.com/blueimp/jQuery-File-Upload/wiki/Security
- Never assume people actually read information about security
- Never rely on .htaccess for security configurations in Apache
- Make sure that published code is secure in all default configurations
- Never allow all file types for upload by default, even if it is secure in your configuration
- Recommend users to not upload files in the same root as their executable web application
- Always follow security best practices, even if it makes setup for users more difficult
I wanted to make it really simple for users to install a generic and secure file upload service with a great user interface.
Unfortunately, security best practices and ease-of-use are often at odds to each other.
Bonus info:
The client-side component had a cross-site scripting vulnerability in the Iframe Transport HTML site back in 2012:
https://github.com/blueimp/jQuery-File-Upload/commit/4175032...
The App Engine components had an open redirect vulnerability back in 2015:
https://github.com/blueimp/jQuery-File-Upload/commit/f74d2a8...