Skip to content
OpenAdvisories
Medium USN-7748-1 2 CVEs

vim vulnerabilities

Published Sep 15, 2025 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Vim incorrectly handled file extraction when opening
maliciously crafted zip or tar archives. An attacker could possibly use
this issue to create or overwrite files on the system and execute arbitrary
code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS vim 2:9.1.0016-1ubuntu7.9

Vulnerabilities 2

  • Medium 4.1
    CVE-2025-53905

    Vim has path traversial issue with tar.vim and special crafted tar files

    Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct…

    vim vim vim vim Debian Ubuntu Azure Linux
  • Medium 4.1
    CVE-2025-53906

    Vim has path traversal issue with zip.vim and special crafted zip archives

    Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct…

    vim vim vim vim Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2025-53905
  • report
    https://ubuntu.com/security/CVE-2025-53906