What is CVE-2025-28168?

CVE-2025-28168 is a medium-severity vulnerability in Multiple File Upload Project, classified under CWE-602. CVSS score: 6.4/10. Published 2025-05-05.

How severe is CVE-2025-28168?

Medium severity. CVSS v3 base score is 6.4 out of 10.

Is CVE-2025-28168 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Arbitrary file upload in Multiple File Upload Project

CVE-2025-28168

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.

EPSS: 0.003 (21.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.

Affected products

Multiple_file_upload_project Multiple_file_upload — versions 3.1.0
Multi Uploaders Multiple File Upload — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

cve@mitre.org (Product)
cve@mitre.org (Third Party Advisory)

Frequently asked questions

What is CVE-2025-28168?: CVE-2025-28168 is a medium-severity vulnerability in Multiple File Upload Project, classified under CWE-602. CVSS score: 6.4/10. Published 2025-05-05.
How severe is CVE-2025-28168?: Medium severity. CVSS v3 base score is 6.4 out of 10.
Is CVE-2025-28168 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.