Paper/Archive/CVE-2025-28168

CVE-2025-28168

Multi Uploaders Multiple File Upload — The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload.

EPSS 0.3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 27.5.275 × 205.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.

Affected

ProductAffectedFixed inSource

Multiple File Upload< 3.1.03.1.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

mitre (CNA)6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refoutsystems.com/forge/component-overview/200/multiple-file-upload-o11 refgist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9