CVE-2025-28168

Name: CVE-2025-28168
Creator: NVD / NIST
Published: 2025-05-05T14:15:28.5+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 0.28%

Last modified Jun 17, 2026

CVE-2025-28168 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. EPSS estimates a 0.28% chance of exploitation in the next 30 days.

Description

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.28%

19.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Multiple File Upload Project	Multiple File Upload	3.1.0

References

https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9Third Party Advisory
https://www.outsystems.com/forge/component-overview/200/multiple-file-upload-o11Product

Timeline

Published: May 5, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-28168?

How severe is CVE-2025-28168?

CVE-2025-28168 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.28% probability of exploitation in the next 30 days.

How do I fix CVE-2025-28168?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-28168?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST