Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

blueimp/jQuery-File-Upload

              master @ 0e92a4d
            

Fixes

CVEs

CRITICAL

Peak severity

70.0%

Coverage

Highlights

Open Redirect: 2 prior fixes. Scrutinize any change in this area.

server/php/UploadHandler.php: most-fixed (6 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Arbitrary Code Execution: Uploaded files were served with a handler that could execute PHP; fixed by forcing application/octet-stream with image exception.

Arbitrary File Upload / Remote Code Execution: Default upload types allowed arbitrary files, enabling RCE on Apache. Fixed with extension allowlist.

Path Traversal: Backslash in filename bypassed basename, allowing traversal via Windows separators.