PT-2025-19707 · Outsystems · Outsystems

Iamleandrooooo · Published 2025-05-05 · Updated 2025-05-05 · CVE-2025-28168

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Outsystems versions prior to 3.1.0

Description The issue arises because file extension and size validations are enforced solely on the client side in the Outsystems Multiple File Upload feature. This allows an attacker to intercept the upload request, modify the parameter, bypass extension restrictions, and upload arbitrary files.

Recommendations For versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider implementing server-side validation for file extensions and sizes to prevent unrestricted file uploads.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

CWE-602

Related Identifiers

CVE-2025-28168

Affected Products

Outsystems

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-28168 · Security Note
• https://osv.dev/vulnerability/CVE-2025-28168 · Vendor Advisory
• https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9 · Note
• https://t.me/cvedetector/24454 · Telegram Post
• https://twitter.com/CVEnew/status/1919386847404257418 · Twitter Post
• https://t.me/cvetracker/23042 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1919407648203526498 · Twitter Post
• https://outsystems.com/forge/component-overview/200/multiple-file-upload-o11 · Note