CVE-2025-28168

MEDIUM

6.4

Beschreibung

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.

CVE Details

CVSS v3.1 Bewertung6.4

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht5/5/2025

Zuletzt geandert9/30/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

multiple_file_upload_project:multiple_file_upload

Schwachen (CWE)

CWE-602CWE-434

Referenzen

https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9(cve@mitre.org)

https://www.outsystems.com/forge/component-overview/200/multiple-file-upload-o11(cve@mitre.org)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.