Path Traversal Vulnerability in Vim Package: Risk of Arbitrary File Overwriting
Summary
UBUNTU-CVE-2025-53905: Vim is an open source, command line text editor. Affects vim versions 2:7.4.000-1ubuntu2 – 2:7.4.052-1ubuntu3.1+esm9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vim is a widely used open-source command line text editor, known for its efficiency and versatility in editing text files. It supports various plugins and features, making it a popular choice among developers and system administrators. However, prior to version 9.1.1552, Vim's tar.vim plugin was susceptible to a path traversal vulnerability, which could allow maliciously crafted tar archives to overwrite arbitrary files on the system.
Vulnerability Detail
The vulnerability arises from a flaw in the tar.vim plugin of Vim, which fails to properly validate file paths when opening tar archives. This oversight can be exploited by an attacker to craft a tar file that, when opened in Vim, can overwrite sensitive files or place executable code in privileged locations. Although the impact is considered low due to the requirement of direct user interaction, successful exploitation could lead to arbitrary command execution on the underlying operating system, posing a significant risk to system integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid opening tar files with Vim until they have updated to the patched version. Additionally, users should exercise caution when handling tar files from untrusted sources.
Conclusion
The path traversal vulnerability in the Vim package poses a risk of arbitrary file overwriting, which could lead to severe consequences if exploited. Users are strongly advised to update to the latest patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for vim →
FAQ
The CVSS score of this vulnerability is 4.1, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow an attacker to overwrite sensitive files or execute arbitrary commands on the system.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If you cannot update Vim immediately, avoid opening tar files from untrusted sources and consider using alternative text editors until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
