CVE-2025-53906 Vim has path traversal issue with zip.vim and special crafted zip archives

Medium 4.1 Published 15 Jul 2025 Updated 1 Apr 2026

Attackers can overwrite arbitrary files and potentially execute code by tricking users into opening malicious zip archives in Vim.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-53906?

CVE-2025-53906 is a medium-severity path traversal vulnerability in Vim Vim, published on 15 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1551 contains a patch for the vulnerability.

Weakness: CWE-22

Which versions are affected by CVE-2025-53906?

It affects 1 product.

Products include Vim Vim.

How do I fix CVE-2025-53906?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-53906 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53906 exists.

All Vim Vim vulnerabilities

Sources

Also known as AZL-65333, AZL-65516, BELL-CVE-2025-53906, DEBIAN-CVE-2025-53906, ECHO-00dd-25a0-cd71, GHSA-r2fw-9cw4-mj86 and 2 more.