PT-2025-29684 · Vim+9 · Vim+10
Ax
·
Published
2025-07-15
·
Updated
2025-11-26
·
CVE-2025-53905
CVSS v3.1
4.1
Medium
| Vector | AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Vim versions prior to 9.1.1552
Description
Vim is an open source, command line text editor. A path traversal issue exists in Vim’s
tar.vim plugin prior to version 9.1.1552, potentially allowing overwriting of arbitrary files when opening specially crafted tar archives. Exploitation requires direct user interaction, but successful exploitation could lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. Editing such a file in Vim reveals the filename and content, potentially alerting a careful user. Successful exploitation could result in the ability to execute arbitrary commands on the underlying operating system.Recommendations
Update Vim to version 9.1.1552 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Vim
Tar.Vim