Arbitrary File Overwrite Vulnerability in Vim Packages
Summary
ALSA-2026:22717: Moderate: vim security update. Affects vim-X11 versions < 2:8.2.2637-26.el9_8.5. Fixed in 2:8.2.2637-26.el9_8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vim (Vi IMproved) is a highly configurable text editor built to enable efficient text editing. It is an enhanced version of the original vi editor, offering features like syntax highlighting, multi-level undo, and extensive plugin support. However, a recent vulnerability has been identified in the Vim zip.vim plugin, which could allow unauthorized file overwrites through a path traversal bypass.
Vulnerability Detail
The vulnerability, identified as CVE-2026-35177, arises from a flaw in the zip.vim plugin of Vim. This flaw allows an attacker to exploit path traversal techniques to overwrite arbitrary files on the system. The potential ramifications include unauthorized access to sensitive files, data corruption, and system instability. The vulnerability affects multiple Vim packages, including vim-X11, vim-common, vim-enhanced, vim-filesystem, and vim-minimal, all of which are part of the AlmaLinux 9 ecosystem.
How To Fix
Minimum fixed version
2:8.2.2637-26.el9_8.5
This is the first release that contains the fix.
sudo dnf update vim-X11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to disable the zip.vim plugin until they can apply the patch. This can be done by commenting out or removing the relevant lines in the Vim configuration file that load the zip.vim plugin.
Conclusion
In summary, the vulnerability identified as CVE-2026-35177 in the Vim zip.vim plugin poses a significant risk of arbitrary file overwrites. Users are strongly encouraged to update their Vim packages to the patched version to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for vim-X11 →
FAQ
CVE-2026-35177 is a vulnerability in the Vim zip.vim plugin that allows for arbitrary file overwrites through path traversal.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor for vulnerabilities.
The risks include unauthorized file access, potential data loss, and system instability due to file corruption.
Yes, you can temporarily disable the zip.vim plugin as a workaround until you can update to the patched version.
More details can be found on the CVE page associated with CVE-2026-35177, which outlines the impact and technical specifics of the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for vim-X11.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
