CVE-2025-53905: Vim Path Traversal Vulnerability

CVE-2025-53905 Overview

CVE-2025-53905 is a path traversal vulnerability [CWE-22] in the tar.vim plugin bundled with Vim, an open source command line text editor. Versions prior to 9.1.1552 fail to sanitize file paths when a user opens a specially crafted tar archive. An attacker who convinces a victim to edit a malicious .tar file can overwrite arbitrary files outside the intended extraction location. Successful exploitation can place executable content in privileged directories or corrupt sensitive files, potentially leading to arbitrary command execution. Version 9.1.1552 contains the patch.

Critical Impact
A crafted tar archive opened in Vim can overwrite arbitrary files under the editing user's permissions, enabling code execution paths through privileged file locations.

Affected Products

Vim versions prior to 9.1.1552
The tar.vim runtime plugin shipped with Vim
Any distribution or platform bundling vulnerable Vim builds

Discovery Timeline

2025-07-15 - CVE-2025-53905 published to NVD
2025-07-15 - Vim security advisory GHSA-74v4-f3x9-ppvr published and patch 9.1.1552 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53905

Vulnerability Analysis

The tar.vim plugin provides in-editor browsing and editing of tar archives. When Vim opens a .tar file, the plugin enumerates archive entries and writes temporary or extracted files to the filesystem. Prior to 9.1.1552, the plugin did not validate entry names for directory traversal sequences such as ../ or absolute paths.

An attacker crafts a tar archive containing entries whose filenames escape the working directory. When the victim opens the archive in Vim, the plugin resolves those paths and writes attacker-controlled content to arbitrary filesystem locations reachable by the user's process. Because the victim sees the filename and content while editing, the attack is not silent, but it does not require privilege escalation to succeed within the user's own permission set.

Root Cause

The root cause is insufficient validation of archive member paths within tar.vim. Archive entries containing traversal sequences or absolute paths are passed to file operations without normalization or containment checks, violating safe archive extraction practices described in [CWE-22].

Attack Vector

Exploitation requires local user interaction. The attacker delivers a malicious .tar file through email, shared storage, a repository, or a supply chain artifact. The victim must open the archive in Vim for the plugin to process the entries. If the editing process runs with elevated permissions, an attacker can place executables in system paths or overwrite configuration files that trigger command execution.

text

// Patch reference from Vim commit 87757c6b0a4b2c1f71c72ea8e1438b8fb116b239
// Filelist additions introducing test samples for the fix
		src/testdir/samples/*.txt \
		src/testdir/samples/*.vim \
		src/testdir/samples/evil.zip \
+		src/testdir/samples/evil.tar \
		src/testdir/samples/poc.zip \
+		src/testdir/samples/sample.tar \
		src/testdir/samples/test.zip

Source: Vim commit 87757c6b. The patch adds evil.tar and sample.tar regression samples exercising the traversal fix in tar.vim.

Detection Methods for CVE-2025-53905

Indicators of Compromise

Tar archive entries containing ../ sequences or absolute paths when inspected with tar -tvf
Unexpected file writes outside the archive extraction directory following a Vim session
New or modified files in privileged directories such as /etc, ~/.ssh, or shell startup files immediately after opening a .tar file

Detection Strategies

Inventory Vim versions across endpoints and flag any build earlier than 9.1.1552
Pre-scan incoming .tar archives for entries with traversal sequences before allowing user access
Correlate vim process execution with subsequent file writes to unrelated directories using endpoint telemetry

Monitoring Recommendations

Alert on file creation events under sensitive paths where the parent process is vim or gvim
Log opens of .tar files sourced from email attachments, shared drives, or downloads
Track integrity of shell configuration files, cron directories, and profile scripts on multi-user systems

How to Mitigate CVE-2025-53905

Immediate Actions Required

Upgrade Vim to version 9.1.1552 or later on all workstations, servers, and container images
Verify OS package repositories have shipped the patched build and force update where necessary
Instruct users to avoid opening untrusted .tar archives directly in Vim until patching is complete

Patch Information

The fix is delivered in Vim 9.1.1552 via commit 87757c6b0a4b2c1f71c72ea8e1438b8fb116b239. See the Vim security advisory GHSA-74v4-f3x9-ppvr and the upstream patch commit for the code changes and regression samples. Additional context is available in the OpenWall oss-security post.

Workarounds

Disable the tar.vim plugin by adding let g:loaded_tarPlugin = 1 to vimrc until the upgrade is applied
Extract untrusted tar archives using hardened tools with traversal protections instead of opening them in Vim
Restrict editing of untrusted archives to non-privileged user accounts to limit the blast radius

bash

# Disable the tar.vim plugin as an interim workaround
echo 'let g:loaded_tarPlugin = 1' >> ~/.vimrc

# Verify installed Vim version meets or exceeds the patched release
vim --version | head -n 1