The vulnerability CVE-2025-69380 in vanquish Upload Files Anywhere plugin allows improper limitation of a pathname to a restricted directory, enabling path traversal attacks. This can lead to unauthorized file uploads outside the designated directories. The affected versions include all versions up to 2.8. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No known exploits in the wild or patch information are currently available.

An attacker can exploit this vulnerability remotely without authentication or user interaction to upload files outside the intended directory, potentially leading to unauthorized disclosure of sensitive information. The impact is limited to confidentiality as per the CVSS vector, with no direct integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to file uploads. Avoid using affected versions in production environments where possible.