CVE-2025-28168CWE-602

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload

Medium · published May 5, 2025

CVSS v3.1
6.4
EPSS
0%
Percentile
26.2
In the wild
Unconfirmed
What it is

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00340 · 26.2th percentile
Weakness
CWE-602 · Client-Side Enforcement of Server-Side Security
Published
2025-05-05T00:00Z
EPSS history
Timeline
  • 05 MAY 00:00Z
    The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload
    cvelistv5