Detections
Analytics
CVE-2025-28168
critical
Description
Outsystems Multiple File Upload < 3.1.0 is vulnerable to Unrestricted File Upload. The vulnerability is because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify the parameter to bypass extension restrictions and upload arbitrary files.
References
https://www.outsystems.com/forge/component-overview/200/multiple-file-upload-o11
https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9