Critical Vulnerability in Vim Packages: Arbitrary File Overwrite via Path Traversal
Summary
ALSA-2026:22711: Moderate: vim security update. Affects vim-X11 versions < 2:9.1.083-9.el10_2.3. Fixed in 2:9.1.083-9.el10_2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim (Vi IMproved) is a highly popular text editor known for its efficiency and versatility in programming and text editing. It offers various enhancements over the traditional vi editor, including syntax highlighting, multi-level undo, and extensive plugin support. However, a recent security vulnerability has been identified in the Vim zip.vim plugin, which could allow attackers to exploit the editor's functionality to overwrite arbitrary files on the system, posing a significant risk to users and their data.
Vulnerability Detail
The vulnerability arises from a path traversal bypass in the Vim zip.vim plugin, identified as CVE-2026-35177. This flaw allows an attacker to manipulate file paths in such a way that they can overwrite files outside of the intended directory. The ramifications of this vulnerability are severe, as it could lead to unauthorized access to sensitive files, data corruption, or system compromise. The technical details indicate that the flaw exists in how the plugin handles zip file paths, failing to properly sanitize user input.
How To Fix
Minimum fixed version
2:9.1.083-9.el10_2.3
This is the first release that contains the fix.
sudo dnf update vim-X11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the zip.vim plugin if it is not essential for their workflow. This can be done by commenting out or removing the relevant lines in the Vim configuration file that load the plugin.
Conclusion
In summary, the vulnerability in the Vim zip.vim plugin poses a significant risk due to its ability to allow arbitrary file overwriting. Users are strongly advised to update their Vim packages to the latest patched version to mitigate this risk. Additionally, temporary workarounds are available for those unable to update immediately.
See every vulnerability recorded for vim-X11 →
FAQ
CVE-2026-35177 is the identifier for a security vulnerability in the Vim zip.vim plugin that allows arbitrary file overwriting through path traversal.
You can check if your Vim installation is affected by visiting the Vulert playground at Vulert Scanner, where you can analyze your manifest file for vulnerabilities.
The potential impacts include unauthorized file access, data corruption, and possible system compromise due to arbitrary file overwriting.
Yes, you can temporarily disable the zip.vim plugin as a workaround until you can apply the update.
More information can be found on the CVE page for CVE-2026-35177, which details the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for vim-X11.
