Path Traversal Vulnerability in Vim Packages: Security Update Required
Summary
ALSA-2025:21015: Moderate: vim security update. Affects vim-X11 versions < 2:9.1.083-6.el10_1. Fixed in 2:9.1.083-6.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim (Vi IMproved) is a highly configurable text editor built to enable efficient text editing. It is widely used for programming and general text manipulation due to its powerful features and extensibility. However, recent vulnerabilities have been identified that could allow unauthorized access to files through path traversal attacks, compromising the integrity and confidentiality of user data.
Vulnerability Detail
The vulnerabilities identified as CVE-2025-53905 and CVE-2025-53906 are path traversal issues in Vim that allow an attacker to manipulate file paths. This can lead to unauthorized file access, potentially exposing sensitive information or allowing malicious modifications. The vulnerabilities arise from improper validation of file paths, which can be exploited by crafting specific input that bypasses security checks.
How To Fix
Minimum fixed version
2:9.1.083-6.el10_1
This is the first release that contains the fix.
sudo dnf update vim-X11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive files and directories, ensuring that only authorized users can interact with them. Additionally, avoid using Vim to open untrusted files until the update is applied.
Conclusion
The identified path traversal vulnerabilities in Vim pose a significant risk to users, allowing unauthorized access to files. It is crucial to update to the patched version to mitigate these risks. Users are encouraged to implement workarounds until the update can be applied and to utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for vim-X11 →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized data access.
You can check your Vim version by running 'vim --version' in your terminal. If it is older than 2:9.1.083-6.el10_1, it is affected by the vulnerabilities.
If you cannot update Vim right away, consider restricting access to sensitive files and avoid opening untrusted files until the update is applied.
More information can be found on the CVE pages for CVE-2025-53905 and CVE-2025-53906, which provide detailed descriptions and impacts of the vulnerabilities.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, allowing you to stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for vim-X11.
