The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload.

published 2025-05-05 18 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-13374

cvss: 6.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits: 0; none known

The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.

Patch / fix

fixed in 1

Multi Uploaders Multiple File Upload 3.1.0

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 18 mo ago (2025-05-05)

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Multi Uploaders Multiple File Upload

Classification

Weakness

CWE-602 Client-Side Enforcement of Server-Side Security
CWE-434 Unrestricted Upload of File with Dangerous Type

References

outsystems.com /forge/component-overview/200/multiple-file-upload-o11
product
gist.github.com /IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9
third-party-advisory

Sources

CVE List CVE-2025-28168
NVD CVE-2025-28168

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary