PT-2026-21160 · Unknown · Vanquish Upload Files Anywhere

Published 2026-02-20 · Updated 2026-02-22 · CVE-2025-69379

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions vanquish Upload Files Anywhere versions prior to and including 2.8

Description The software contains a flaw related to improper limitation of a pathname to a restricted directory, specifically a 'Path Traversal' issue. This impacts the Upload Files Anywhere component, allowing for potential unauthorized access or manipulation of files due to insufficient validation of file paths.

Recommendations Update vanquish Upload Files Anywhere to a version newer than 2.8.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-69379

Affected Products

Vanquish Upload Files Anywhere

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-69379 · Security Note
• https://twitter.com/CVEnew/status/2025425491122159834 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/wp-upload-files-anywhere/vulnerability/wordpress-upload-files-anywhere-plugin-2-8-arbitrary-file-deletion-vulnerability?_s_id=cve · Note