Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1551 contains a patch for the vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 4.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade vim-X11Upgrade vim-enhancedUpgrade vim-filesystemUpgrade vim-commonUpgrade vim-minimal | Oct 14, 2025 | Oct 9, 2025 |
| Amazon_linux_2023 | — | Upgrade xxd-debuginfoUpgrade xxdUpgrade vim-debuginfoUpgrade vim-minimal-debuginfoUpgrade vim-commonUpgrade vim-dataUpgrade vim-filesystemUpgrade vim-debugsourceUpgrade vim-enhanced-debuginfoUpgrade vim-minimalUpgrade vim-default-editorUpgrade vim-enhanced | Aug 19, 2025 | Jul 15, 2025 |
| Apple Osx Vim | — | Upgrade macOS to the latest version | Nov 28, 2025 | Nov 3, 2025 |
| Debian | — | No solution exists | Jul 17, 2025 | Jul 15, 2025 |
| Gentoo Linux | — | Upgrade app-editors/vim.Upgrade app-editors/gvim.Upgrade app-editors/vim-core. | Jan 27, 2026 | Jan 26, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade vim-filesystemUpgrade vim-minimalUpgrade vim-enhancedUpgrade vim-common | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade vim-filesystemUpgrade vim-enhancedUpgrade vim-minimalUpgrade vim-common | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade vim-enhancedUpgrade vim-minimalUpgrade vim-filesystemUpgrade vim-common | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade vim-commonUpgrade vim-filesystemUpgrade vim-enhancedUpgrade vim-minimal | Oct 24, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp9 | — | Upgrade vim-commonUpgrade vim-filesystemUpgrade vim-minimalUpgrade vim-enhanced | Jan 8, 2026 | Jan 7, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Dec 15, 2025 |
| Oracle_linux | — | Upgrade vim-enhancedUpgrade vim-filesystemUpgrade vim-minimalUpgrade vim-dataUpgrade vim-X11Upgrade xxdUpgrade vim-common | Oct 13, 2025 | Jul 15, 2025 |
| Redhat_linux | — | Upgrade vim-common-debuginfoUpgrade vim-debugsourceUpgrade vim-X11-debuginfoNo solution existsUpgrade vim-debuginfoUpgrade vim-enhancedUpgrade vim-filesystemUpgrade vim-commonUpgrade vim-X11Upgrade vim-minimal-debuginfoUpgrade vim-dataUpgrade xxd-debuginfoUpgrade xxdUpgrade vim-enhanced-debuginfoUpgrade vim-minimal | Jul 16, 2025 | Jul 15, 2025 |
| Rocky_linux | — | Upgrade vim-debuginfoUpgrade vim-commonUpgrade vim-X11Upgrade xxdUpgrade xxd-debuginfoUpgrade vim-minimal-debuginfoUpgrade vim-minimalUpgrade vim-enhancedUpgrade vim-enhanced-debuginfoUpgrade vim-X11-debuginfoUpgrade vim-common-debuginfoUpgrade vim-debugsource | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade vim-data-commonUpgrade vim-smallUpgrade vimUpgrade gvimUpgrade vim-data | Dec 5, 2025 | Oct 10, 2025 |
| Ubuntu | — | Upgrade vim | Sep 16, 2025 | Jul 15, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jul 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub