CVE-2025-28168

—

CVSS 3.1

9.8 critical

EPSS

<1%p25

Published

May 5, 2025 (May 5, 2025)

Modified

Jun 17, 2026

Description

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.

Vendors: multiple file upload project
Products: multiple file upload
Weakness: CWE-602, CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.