Path traversal in Vim - CVE-2026-35177

Vulnerability identifier: #VU125036

CSH Severity: Medium

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-35177

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to overwrite arbitrary files.

The vulnerability exists due to path traversal in zip.vim when processing specially crafted zip archives. A remote attacker can trick the victim into opening a crafted archive and editing a malicious file within it to overwrite arbitrary files.

User interaction is required, and the file is written when the victim attempts to save it using :w.

Vim
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Ubuntu
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
vim (Ubuntu package)
vim (Red Hat package)
vim-filesystem
vim-minimal
vim-enhanced
vim-common
vim-X11
vim-debugsource
vim-debuginfo
vim

Install security update from vendor's website.

Vim - update to 9.2.0280
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm25, 2:7.4.052-1ubuntu3.1+esm30, 2:7.4.1689-3ubuntu1.5+esm31, 2:7.4.1689-3ubuntu1.5+esm36, 2:8.0.1453-1ubuntu1.13+esm16, 2:8.0.1453-1ubuntu1.13+esm21, 2:8.1.2269-1ubuntu5.32+esm4, 2:8.1.2269-1ubuntu5.32+esm9, 2:8.2.3995-1ubuntu2.28, 2:8.2.3995-1ubuntu2.29, 2:8.2.3995-1ubuntu2.33, 2:9.1.0016-1ubuntu7.12, 2:9.1.0016-1ubuntu7.13, 2:9.1.0016-1ubuntu7.17, 2:9.1.0967-1ubuntu6.3, 2:9.1.0967-1ubuntu6.4, 2:9.1.0967-1ubuntu6.8, 2:9.1.2141-1ubuntu4.1, 2:9.1.2141-1ubuntu4.6
vim (Red Hat package) - addressed in versions 8.0.1763-15.el8_4.2, 8.0.1763-19.el8_6.6, 8.0.1763-20.el8_8.2, 8.2.2637-20.el9_2.2, 8.2.2637-20.el9_4.3, 8.2.2637-22.el9_6.3, 9.1.083-9.el10_2.3
vim-filesystem - update to 8.0.1763-23.0.1
vim-minimal - update to 8.0.1763-23.0.1
vim-enhanced - update to 8.0.1763-23.0.1
vim-common - update to 8.0.1763-23.0.1
vim-X11 - update to 8.0.1763-23.0.1
vim-filesystem - update to 9.0.2092-31
vim-minimal - update to 9.0.2092-31
vim-enhanced - update to 9.0.2092-31
vim-debugsource - update to 9.0.2092-31
vim-debuginfo - update to 9.0.2092-31
vim-common - update to 9.0.2092-31
vim-X11 - update to 9.0.2092-31
vim - update to 9.0.2092-31

• https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24

• Path traversal in Vim
• Ubuntu update for vim
• openEuler update for vim
• Ubuntu update for vim
• Red Hat Enterprise Linux 10 update for vim
• Anolis OS update for vim
• Red Hat Enterprise Linux 9 update for vim
• Red Hat Enterprise Linux 9 update for vim
• Red Hat Enterprise Linux 9 update for vim
• Red Hat Enterprise Linux 8 update for vim
• Red Hat Enterprise Linux 8 update for vim
• Red Hat Enterprise Linux 8 update for vim
• Ubuntu update for vim