The vulnerability CVE-2025-69380 involves improper limitation of a pathname to a restricted directory in the Upload Files Anywhere plugin by vanquish. This path traversal issue allows attackers to upload files outside the intended directory, potentially compromising system confidentiality. The vulnerability affects all versions up to 2.8. It has a CVSS 3.1 base score of 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. No patch or official remediation information is currently available.

An attacker can exploit this vulnerability remotely without authentication to upload files outside the designated directories, potentially leading to unauthorized disclosure of sensitive information. The impact is limited to confidentiality as per the CVSS vector; integrity and availability are not affected. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and monitor for suspicious file uploads. Avoid exposing the plugin to untrusted users. Follow vendor communications for updates on patches or mitigations.