The vulnerability CVE-2025-69379 in vanquish Upload Files Anywhere plugin allows improper limitation of a pathname to a restricted directory, enabling path traversal attacks. This means an attacker can upload files outside the intended directory, potentially disrupting service availability. The issue affects all versions up to 2.8. The CVSS 3.1 base score is 8.6, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact is limited to availability, with no confidentiality or integrity loss indicated. There is no vendor advisory or patch information available at this time.

The vulnerability can be exploited remotely without authentication or user interaction to cause a denial of service condition by uploading files outside the intended directory. There is no direct impact on confidentiality or integrity reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the use of the Upload Files Anywhere plugin to mitigate potential exploitation.