CVE-2025-28168

Katalog CVE

CVSS 9.8 · Critical EPSS 0,34%

Kerentanan Client-Side Enforcement of Server-Side Security pada multiple file upload project multiple file upload. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.

Rincian

Terbit di NVD

5 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-602: Client-Side Enforcement of Server-Side Security
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9 advisory pihak ketiga
• https://www.outsystems.com/forge/component-overview/200/multiple-file-upload-o11 product