CVE-2025-28168

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-28168
The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.

6.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9
https://www.outsystems.com/forge/component-overview/200/multiple-file-upload-o11
Configurations

No configuration.

History

08 May 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : 6.4
CWE CWE-602
Summary (en) Outsystems Multiple File Upload < 3.1.0 is vulnerable to Unrestricted File Upload. The vulnerability is because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify the parameter to bypass extension restrictions and upload arbitrary files. (en) The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.

07 May 2025, 19:16

Type Values Removed Values Added
Summary
  • (es) La versión anterior a la 3.1.0 de Outsystems Multiple File Upload es vulnerable a la carga de archivos sin restricciones. Esta vulnerabilidad se debe a que las validaciones de extensión y tamaño de archivo se aplican únicamente en el lado del cliente. Un atacante puede interceptar la solicitud de carga y modificar el parámetro para eludir las restricciones de extensión y cargar archivos arbitrarios.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
CWE CWE-434

05 May 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-05 14:15

Updated : 2025-05-08 18:15

NVD link : CVE-2025-28168

Mitre link : CVE-2025-28168

CVE.ORG link : CVE-2025-28168

JSON object : View

Products Affected

No product.

CWE
CWE-602

Client-Side Enforcement of Server-Side Security

CWE-434

Unrestricted Upload of File with Dangerous Type