CVE-2025-28168
Last modified
CVE-2025-28168 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Multiple File Upload Project | Multiple File Upload | 3.1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-28168?
How severe is CVE-2025-28168?
How do I fix CVE-2025-28168?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-28145Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1…6.5
- CVE-2025-28146Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1…9.8
- CVE-2025-2815The Administrator Z plugin for WordPress is vulnerable to un…8.8
- CVE-2025-2816The Page View Count plugin for WordPress is vulnerable to un…8.1
- CVE-2025-28162Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows…5.5
- CVE-2025-28164Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows…5.5
- CVE-2025-28169BYD QIN PLUS DM-i Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13…8.1
- CVE-2025-2817Thunderbird's update mechanism allowed a medium-integrity us…8.8
- CVE-2025-28170Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to In…7.6
- CVE-2025-28171An issue in Grandstream UCM6510 v.1.0.20.52 and before allow…6.5
- CVE-2025-28172Grandstream Networks UCM6510 v1.0.20.52 and before is vulner…6.5
- CVE-2025-2818A vulnerability was reported in version 1.0 of the Bluetooth…5.1
Are you affected by CVE-2025-28168?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST