Moderate Vulnerability in Vim Packages: Arbitrary File Overwrite via Path Traversal Bypass
Summary
ALSA-2026:22730: Moderate: vim security update. Affects vim-X11 versions < 2:8.0.1763-23.el8_10. Fixed in 2:8.0.1763-23.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vim (Vi IMproved) is a highly configurable text editor built to enable efficient text editing. It is an improved version of the original vi editor and is widely used for programming and general text manipulation. The package includes various components such as vim-X11, vim-common, vim-enhanced, vim-filesystem, and vim-minimal, each serving different functionalities within the Vim ecosystem. This vulnerability affects these packages by allowing an attacker to exploit a flaw in the zip.vim plugin, leading to potential unauthorized file overwrites.
Vulnerability Detail
The vulnerability identified as CVE-2026-35177 allows for arbitrary file overwrites through a path traversal bypass in the zip.vim plugin of Vim. This issue arises when the plugin fails to properly validate file paths, enabling attackers to manipulate file paths and overwrite sensitive files on the system. The ramifications of this vulnerability can be severe, potentially leading to data loss, unauthorized access, or system compromise, depending on the files targeted by the attacker.
How To Fix
Minimum fixed version
2:8.0.1763-23.el8_10
This is the first release that contains the fix.
sudo dnf update vim-X11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the zip.vim plugin if it is not essential for their workflow. This can be done by commenting out or removing the relevant lines in the Vim configuration file (usually located at ~/.vimrc) that load the zip.vim plugin.
Conclusion
In summary, the vulnerability CVE-2026-35177 poses a moderate risk to users of Vim due to a flaw in the zip.vim plugin that allows for arbitrary file overwrites. It is crucial to update to the patched version of the affected packages to safeguard against potential exploits. Users can also utilize Vulert to monitor and check for vulnerabilities in their applications.
See every vulnerability recorded for vim-X11 →
FAQ
CVE-2026-35177 is the identifier for a vulnerability in the Vim zip.vim plugin that allows for arbitrary file overwrites due to a path traversal bypass.
You can check if your Vim installation is affected by visiting the Vulert playground at Vulert Scanner, where you can analyze your manifest file without needing to sign up.
The consequences can include unauthorized file overwrites, data loss, and potential system compromise, depending on the files targeted by an attacker.
Yes, a patch is available in the updated version 2:8.0.1763-23.el8_10 of the affected Vim packages.
If you cannot update immediately, consider disabling the zip.vim plugin as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for vim-X11.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
