Magento 2 uses the Blueimp jQuery File Upload Plugin v5.16.4 which has recently been identified at posing a security risk to web applications which use it.

Is this an issue for Magento and should this file be patched or replaced with a more recent version?

I see there is some PHP validation prohibiting uploading of certain file types (see exampled below) so perhaps it's not required?

Also, the blueimp patch for fixing this is for a file which Magento does not seem to use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.