CVE-2025-28168 Information

Description

Outsystems Multiple File Upload < 3.1.0 is vulnerable to Unrestricted File Upload. The vulnerability is because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify the parameter to bypass extension restrictions and upload arbitrary files.

Reference

https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9 https://www.outsystems.com/forge/component-overview/200/multiple-file-upload-o11