Path traversal in Vim - CVE-2025-53905

Vulnerability identifier: #VU112980

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-53905

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences in tar.vim plugin. A remote attacker can trick the victim into opening a specially crafted archive and overwrite arbitrary files on the system, leading to remote code execution. 

Vim
Gentoo Linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Desktop Applications Module
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Fedora
Financial Transaction Manager for RedHat OpenShift
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
vim (Red Hat package)
vim-X11
vim-common
vim-enhanced
vim-minimal
vim-filesystem
vim
vim-debugsource
vim-debuginfo
vim (Ubuntu package)
vim-data
vim-data-common
gvim-debuginfo
gvim
vim-small-debuginfo
vim-small
app-editors/gvim
app-editors/vim
app-editors/vim-core
IBM Cloud Pak for Business Automation
AppDynamics NodeJS Agent
Cryostat
Red Hat OpenShift Serverless
OpenShift Virtualization
Juniper Junos Space

Install updates from vendor's website.

Vim - update to 9.1.1552
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF008, 24.0.1-IF006, 25.0.0-IF004
AppDynamics NodeJS Agent - update to 25.12.1
Red Hat OpenShift Serverless - update to 1
Cryostat - update to 4.1.0
OpenShift Virtualization - update to 4.19.17
vim (Red Hat package) - addressed in versions 8.0.1763-21.el8_10, 8.2.2637-20.el9_4.1, 8.2.2637-22.el9_6.1, 9.1.083-5.el10_0.1
vim-X11 - update to 8.0.1763-21.0.1
vim-common - update to 8.0.1763-21.0.1
vim-enhanced - update to 8.0.1763-21.0.1
vim-minimal - update to 8.0.1763-21.0.1
vim-filesystem - update to 8.0.1763-21.0.1
vim - addressed in versions 9.0-35, 9.0.2092-20
vim-filesystem - addressed in versions 9.0-35, 9.0.2092-20
vim-minimal - addressed in versions 9.0-35, 9.0.2092-20
vim-enhanced - addressed in versions 9.0-35, 9.0.2092-20
vim-debugsource - addressed in versions 9.0-35, 9.0.2092-20
vim-debuginfo - addressed in versions 9.0-35, 9.0.2092-20
vim-common - addressed in versions 9.0-35, 9.0.2092-20
vim-X11 - addressed in versions 9.0-35, 9.0.2092-20
vim (Ubuntu package) - addressed in versions 2:9.1.0016-1ubuntu7.9, 2:9.1.0967-1ubuntu4.1
vim - addressed in versions 9.1.1552-1.fc41, 9.1.1552-1.fc42
vim-data - addressed in versions 9.1.1629-17.51.1, 9.1.1629-150500.20.33.1
vim - addressed in versions 9.1.1629-17.51.1, 9.1.1629-150500.20.33.1
vim-debugsource - addressed in versions 9.1.1629-17.51.1, 9.1.1629-150000.5.78.1, 9.1.1629-150500.20.33.1
vim-data-common - addressed in versions 9.1.1629-17.51.1, 9.1.1629-150000.5.78.1, 9.1.1629-150500.20.33.1
gvim-debuginfo - addressed in versions 9.1.1629-17.51.1, 9.1.1629-150500.20.33.1
gvim - addressed in versions 9.1.1629-17.51.1, 9.1.1629-150500.20.33.1
vim-debuginfo - addressed in versions 9.1.1629-17.51.1, 9.1.1629-150000.5.78.1, 9.1.1629-150500.20.33.1
vim-small-debuginfo - addressed in versions 9.1.1629-150000.5.78.1, 9.1.1629-150500.20.33.1
vim-small - addressed in versions 9.1.1629-150000.5.78.1, 9.1.1629-150500.20.33.1
app-editors/gvim - update to 9.1.1652
app-editors/vim - update to 9.1.1652
app-editors/vim-core - update to 9.1.1652
Juniper Junos Space - update to 26.1R1 Patch V1

• https://github.com/vim/vim/security/advisories/GHSA-74v4-f3x9-ppvr

• Arbitrary file overwrite in Vim tar.vim plugin
• Fedora 42 update for vim
• Fedora 41 update for vim
• openEuler 22.03 LTS SP3 update for vim
• openEuler 24.03 LTS SP2 update for vim
• openEuler 22.03 LTS SP4 update for vim
• openEuler 24.03 LTS update for vim
• openEuler 20.03 LTS SP4 update for vim
• openEuler 24.03 LTS SP1 update for vim
• Ubuntu update for vim
• SUSE update for vim
• SUSE update for vim
• SUSE update for vim
• Red Hat Enterprise Linux 9 update for vim
• Red Hat Enterprise Linux 8 update for vim
• Red Hat Enterprise Linux 9 update for vim
• Anolis OS update for vim
• Red Hat Enterprise Linux 10 update for vim
• Multiple vulnerabilities in IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Multiple vulnerabilities in Red Hat build of Cryostat
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in OpenShift Virtualization 4.19
• Gentoo update for Vim, gVim
• Splunk AppDynamics NodeJS Agent update for third-party components
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Junos Space