Listen to this Post
How the CVE Works
CVE-2025-29768 affects Vim’s zip.vim plugin when handling specially crafted ZIP archives. When a user opens a malicious ZIP file in Vim and presses ‘x’ to extract a file with a manipulated filename, the plugin may inadvertently delete unintended files due to improper path sanitization. The vulnerability stems from insufficient validation of filenames within the ZIP archive, leading to directory traversal or unintended file operations. This requires user interaction (opening the ZIP and pressing ‘x’), limiting its severity. The flaw was patched in Vim 9.1.1198.
DailyCVE Form
Platform: Vim
Version: < 9.1.1198
Vulnerability: Arbitrary file deletion
Severity: Medium
Date: 08/18/2025
Prediction: Patch expected by 03/15/2025
What Undercode Say
vim --version | grep "patch" Check installed version unzip -l malicious.zip Inspect ZIP contents before extraction
How Exploit
- Craft a ZIP with a filename containing “../” sequences.
- User opens ZIP in Vim and presses ‘x” on the malicious entry.
- Vim deletes files outside the intended directory.
Protection from this CVE
- Update to Vim ≥ 9.1.1198.
- Disable zip.vim plugin if unused.
- Avoid extracting untrusted ZIPs in Vim.
Impact
- Local file deletion.
- User-assisted exploitation.
- Medium integrity compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
