CVE-2026-35177
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Vim, the zip.vim plugin before version 9.2.0280 contains a path traversal bypass that allows overwriting arbitrary files when opening specially crafted zip archives. This vulnerability circumvents the previous fix for CVE-2025-53906.
Risk Assessment
An attacker can overwrite arbitrary files on the victim's system, potentially leading to system compromise or data corruption.
Recommendation
Immediately update Vim to version 9.2.0280 or later.
Original NVD description (English source)
Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives, circumventing the previous fix for CVE-2025-53906. This vulnerability is fixed in 9.2.0280.