CVE-2025-53905Path Traversal in Azl3 VIM 9.1.1552-1 ON Azure Linux 3.0

CWE-22Path Traversal6 documents6 sources
Severity
4.1MEDIUMNVD
EPSS
0.0%
top 92.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 15
Latest updateSep 15

Description

Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a fi

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:LExploitability: 1.0 | Impact: 2.7

Affected Packages7 packages

NVDvim/vim< 9.1.1552
debiandebian/vim< vim 2:9.1.1829-1 (forky)
Debianvim/vim< 2:9.1.1829-1

Patches

🔴Vulnerability Details

1
OSV
CVE-2025-53905: Vim is an open source, command line text editor2025-07-15

📋Vendor Advisories

4
Ubuntu
Vim vulnerabilities2025-09-15
Red Hat
vim: Vim path traversial2025-07-15
Microsoft
Vim has path traversial issue with tar.vim and special crafted tar files2025-07-08
Debian
CVE-2025-53905: vim - Vim is an open source, command line text editor. Prior to version 9.1.1552, a pa...2025
CVE-2025-53905 — Path Traversal | cvebase