CVE-2026-35177: Path traversal issue with zip.vim in Vim
Last updated 2 July 2026
Other sources
Path traversal issue with zip.vim in Vim
— Microsoft
Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives, circumventing the previous fix for CVE-2025-53906. This vulnerability is fixed in 9.2.0280.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0315-1 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.1.1230-2+deb13u1Fixed in 2:9.2.0858-1 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.1.1230-2+deb13u1 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.2.0315-1 - Upgrade
Upgrade
alpine/vimto a version that resolves this vulnerability.Fixed in 9.2.0280-r0 - Upgrade
Upgrade
Vim (zip.vim)to a version that resolves this vulnerability.Fixed in 9.2.0280