VulnerabilityAnalyzed

CVE-2025-28168

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload.

CRITICAL 9.8EPSS 0.33%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.33% probability · 26th percentile
CISA KEV: Not listed
Weakness: CWE-602, CWE-434
Affected: multiple file upload project/multiple file upload
Source: cve@mitre.org

References

https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9Third Party Advisory
https://www.outsystems.com/forge/component-overview/200/multiple-file-upload-o11Product

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.