{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Outsystems Multiple File Upload \u003c 3.1.0 is vulnerable to Unrestricted File Upload. The vulnerability is because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify the parameter to bypass extension restrictions and upload arbitrary files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-05T13:21:46.662Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.outsystems.com/forge/component-overview/200/multiple-file-upload-o11"
        },
        {
          "url": "https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-28168",
    "datePublished": "2025-05-05T00:00:00.000Z",
    "dateReserved": "2025-03-11T00:00:00.000Z",
    "dateUpdated": "2025-05-05T13:21:46.662Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-28168\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2025-05-05T14:15:28.500\",\"lastModified\":\"2025-05-05T14:15:28.500\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Outsystems Multiple File Upload \u003c 3.1.0 is vulnerable to Unrestricted File Upload. The vulnerability is because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify the parameter to bypass extension restrictions and upload arbitrary files.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.outsystems.com/forge/component-overview/200/multiple-file-upload-o11\",\"source\":\"cve@mitre.org\"}]}}"
  }
}