CVE-2025-28168: Medium File Upload Bypass in OutSystems Multi File Upload

CVE-2025-28168 is a medium severity (CVSS 6.4) unrestricted file upload flaw in version 3.1.0 of the Multiple File Upload component for OutSystems. Extension and size checks run only in the browser, so a modified request can bypass them. Add server-side validation. The record names no fixed version.

What's affected

The record says the Multiple File Upload add-on component 3.1.0 for OutSystems is affected. It also notes that this is a third-party component that is not supplied or supported by OutSystems, so the OutSystems platform itself is not the subject of the report.

The component is listed on the OutSystems Forge. The record gives no fixed version, so check the Forge page for an update and for notes from the component's author.

Severity in the record: medium, CVSS 6.4, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. Weakness classes: CWE-434 (Unrestricted file upload), CWE-602 (Client-side enforcement of server-side security).

How to check if you're exposed

In Service Studio, open your application's dependencies and look for the Multiple File Upload component. Note the version. Version 3.1.0 is the one named in the record.

Then review every screen that uses the upload widget and find the server action that receives the file. Check whether that action validates the extension, the content type and the size itself, or relies on settings in the widget.

Finally, look at where uploaded files go. If they are stored in a place that is served back to users, see whether any file type could be run or rendered as active content.

What to do now

1. Check the Forge page for a newer version of the component and review its release notes.
2. Add server-side validation to every action that receives an upload: allow list of extensions, content sniffing of the real file type, and a maximum size.
3. Store uploads outside any location that the server executes, and serve them with a safe content type and a download header.
4. Scan uploaded files for malware if your policy requires it.
5. Rename uploaded files on the server so that user-supplied names are never used as paths.
6. Consider replacing the component with a supported upload feature if the author does not respond.

Why it matters

CWE-602 is client-side enforcement of server-side security. A browser is under the user's control, so any check that runs only there is advice, not a rule. A person who can modify the request can change the parameters that the client script would have enforced. The record describes exactly this: the extension restrictions are enforced solely on the client, and an intercepted request can be modified to upload arbitrary files, which is CWE-434.

The score is medium because the attacker needs a low privileged account and the impact scores are low. What it means for you depends on what happens to uploads next. A file that is stored and never opened is a small risk, and a file that is served back or processed by another system can be a large one.

The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.

Quick check

Sources

• OutSystems Forge component page
• Reporter's write-up (GitHub Gist)
• Safeguard Gold entry for CVE-2025-28168

Last reviewed: 19 October 2026.