CVE-2026-35177: Vim Path Traversal Vulnerability

CVE-2026-35177 Overview

CVE-2026-35177 is a path traversal bypass vulnerability in Vim's zip.vim plugin that allows attackers to overwrite arbitrary files when a user opens a specially crafted zip archive. This vulnerability circumvents the previous fix implemented for CVE-2025-53906, demonstrating that the original patch was insufficient to fully address the underlying security issue. The vulnerability exists in Vim versions prior to 9.2.0280.

Critical Impact

Opening a malicious zip archive in Vim could lead to arbitrary file overwrite, potentially allowing attackers to modify critical system files, configuration files, or inject malicious code into executable scripts.

Affected Products

• Vim versions prior to 9.2.0280
• Systems using Vim's zip.vim plugin for viewing zip archives
• Any environment where users may open untrusted zip files with Vim

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-35177 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35177

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), a type of Directory Traversal vulnerability. The zip.vim plugin in Vim is designed to allow users to view and extract contents from zip archives directly within the editor. When processing file paths within a zip archive, the plugin fails to properly sanitize path components, allowing specially crafted archives to bypass the security fix previously implemented for CVE-2025-53906.

The attack requires local access and user interaction—specifically, a victim must open a malicious zip archive using Vim. While the attack complexity is high due to the need to craft a specific bypass payload, successful exploitation can affect resources beyond the scope of the vulnerable component, potentially impacting system integrity and availability.

Root Cause

The root cause lies in incomplete input validation within the zip.vim plugin's file path handling logic. While the previous patch for CVE-2025-53906 attempted to sanitize path traversal sequences like ../, the fix did not account for all possible encoding variations or bypass techniques that attackers could use to escape the intended extraction directory. This allowed crafted zip archives to still write files to arbitrary locations on the filesystem.

Attack Vector

The attack requires local access to the target system and user interaction. An attacker must:

1. Craft a malicious zip archive containing files with specially formatted path traversal sequences that bypass existing sanitization
2. Convince a victim to open the malicious zip archive using Vim
3. When the victim opens or extracts files from the archive, the path traversal bypass triggers, writing files to unintended locations

The vulnerability mechanism exploits weaknesses in path normalization. When the zip.vim plugin processes filenames from the archive, the bypass technique circumvents the security checks, allowing directory escape sequences to be processed. This can result in files being written outside the intended extraction directory. For detailed technical information about the bypass technique, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35177

Indicators of Compromise

• Unexpected file modifications in system directories or user home directories after opening zip archives in Vim
• Creation of new files in locations outside the expected extraction directory
• Modified configuration files (.bashrc, .vimrc, .ssh/authorized_keys) with unexpected content
• Presence of zip archives with unusual or deeply nested directory structures in recent file access logs

Detection Strategies

• Monitor file system activity when Vim processes zip archives, specifically watching for writes outside the current working directory
• Implement file integrity monitoring (FIM) on critical system files and configuration directories
• Deploy endpoint detection rules that alert on unexpected file creation following Vim execution
• Audit recent zip archive interactions on systems where Vim is commonly used

Monitoring Recommendations

• Enable comprehensive file access logging on critical systems
• Monitor for Vim processes writing to sensitive directories like /etc/, ~/.ssh/, or system binary locations
• Implement alerting for modification of shell initialization files or SSH configuration after Vim execution
• Review access logs for zip archives received from untrusted sources

How to Mitigate CVE-2026-35177

Immediate Actions Required

• Upgrade Vim to version 9.2.0280 or later immediately
• Avoid opening zip archives from untrusted sources using Vim until patched
• Consider temporarily disabling the zip.vim plugin if upgrade is not immediately possible
• Audit systems for any signs of compromise if untrusted zip files were recently opened

Patch Information

The vulnerability is fixed in Vim version 9.2.0280. Users should upgrade to this version or later to fully remediate the vulnerability. The fix addresses the path traversal bypass that circumvented the previous CVE-2025-53906 patch. For additional details, see the GitHub Security Advisory.

Workarounds

• Disable the zip.vim plugin by adding let g:loaded_zipPlugin = 1 to your .vimrc configuration file
• Use alternative tools for viewing zip archive contents until Vim can be upgraded
• Implement strict file download policies preventing untrusted zip archives from reaching end-user systems
• Configure application whitelisting to prevent execution of scripts that may have been overwritten

# Disable zip.vim plugin in Vim configuration
echo 'let g:loaded_zipPlugin = 1' >> ~/.vimrc

# Verify Vim version after upgrade
vim --version | head -1

# Check if zip plugin is loaded (should return nothing if disabled)
vim -c 'echo exists("g:loaded_zipPlugin")' -c 'q'