CVE-2025-53905 Vim has path traversial issue with tar.vim and special crafted tar files

Medium 4.1 Published 15 Jul 2025 Updated 4 Nov 2025

Attackers can overwrite arbitrary files and potentially execute code by tricking users into opening malicious tar archives in Vim.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-53905?

CVE-2025-53905 is a medium-severity path traversal vulnerability in Vim Vim, published on 15 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.

Weakness: CWE-22

Which versions are affected by CVE-2025-53905?

It affects 1 product.

Products include Vim Vim.

How do I fix CVE-2025-53905?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-53905 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53905 exists.

All Vim Vim vulnerabilities

Sources

Also known as AZL-65330, AZL-65513, BELL-CVE-2025-53905, CLSA-2025-1766597554, DEBIAN-CVE-2025-53905, ECHO-4d91-60a7-208c and 3 more.