Security Vulnerability in Vim Packages: Path Traversal Issues
Summary
ALSA-2025:17913: Moderate: vim security update. Affects vim-X11 versions < 2:9.1.083-5.el10_0.1. Fixed in 2:9.1.083-5.el10_0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim (Vi IMproved) is an enhanced version of the traditional vi editor, widely used for text editing in various environments. It offers features like syntax highlighting, multi-level undo, and extensive plugin support, making it a popular choice among developers and system administrators. However, recent vulnerabilities have been identified that could allow unauthorized access to file paths, compromising the integrity of the system.
Vulnerability Detail
The identified vulnerabilities, CVE-2025-53905 and CVE-2025-53906, are related to path traversal issues in Vim. These vulnerabilities can allow an attacker to manipulate file paths, potentially leading to unauthorized access to sensitive files on the system. The vulnerabilities arise from improper validation of user input, which can be exploited to traverse directories and access files outside the intended scope. This could result in data leakage or unauthorized modifications, posing a significant risk to system security.
How To Fix
Minimum fixed version
2:9.1.083-5.el10_0.1
This is the first release that contains the fix.
sudo dnf update vim-X11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the permissions of the Vim editor or avoid using it for sensitive file operations until the update is applied. Additionally, consider using alternative text editors that do not have these vulnerabilities.
Conclusion
The vulnerabilities in Vim pose a significant risk due to path traversal issues that can lead to unauthorized file access. It is crucial to update to the patched version to mitigate these risks. Users should also consider temporary workarounds until the update can be applied.
See every vulnerability recorded for vim-X11 →
FAQ
The vulnerabilities are related to path traversal, allowing unauthorized access to files outside the intended directory.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider using alternative text editors or restrict the use of Vim for sensitive operations.
You can check your installed version of Vim by running the command vim --version in your terminal.
Yes, several packages related to Vim, including vim-common, vim-data, vim-enhanced, vim-filesystem, and vim-minimal, are also affected.
Related vulnerabilities
Recent vulnerabilities recorded for vim-X11.
