Path Traversal Vulnerability in Upload Files Anywhere Plugin by Vanquish

CVE-2025-69379

What is CVE-2025-69379?

A vulnerability has been identified in the Upload Files Anywhere plugin, developed by Vanquish, which permits attackers to exploit improper limitations on filenames, resulting in path traversal scenarios. This flaw enables unauthorized access to files in restricted directories, potentially allowing malicious users to manipulate the file system of the hosting server. Websites utilizing versions of this plugin up to 2.8 are particularly at risk, as they may inadvertently permit attackers to read sensitive files or execute unintended commands.

References