PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35177 vim CVE debrief

CVE-2026-35177 is a MEDIUM severity vulnerability in Vim's zip.vim plugin. Prior to 9.2.0280, a path traversal bypass allows overwriting of arbitrary files when opening specially crafted zip archives. This vulnerability is fixed in 9.2.0280. The vulnerability has a CVSS score of 4.1 and is considered a significant risk for users of affected Vim versions. Users of Vim versions prior to 9.2.0280 who handle zip archives within the editor are at risk. This includes developers, system administrators, and users who work with zip files in Vim.

Vendor
vim
Product
Unknown
CVSS
MEDIUM 4.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Users of Vim versions prior to 9.2.0280 who handle zip archives within the editor are at risk. This includes developers, system administrators, and users who work with zip files in Vim. These users should verify their deployments and review the official advisory for affected scope and severity.

Technical summary

A path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives. The vulnerability is fixed in Vim version 9.2.0280. Users of affected versions should apply the patch or upgrade to prevent exploitation. This vulnerability has a CVSS score of 4.1 and is considered a significant risk for users of affected Vim versions. The vulnerability affects Vim versions prior to 9.2.0280.

Defensive priority

Apply the patch or upgrade to Vim version 9.2.0280 or later as soon as possible. Restrict access to zip archives. Monitor for suspicious activity.

Recommended defensive actions

  • Apply the patch or upgrade to Vim version 9.2.0280 or later.
  • Restrict access to zip archives.
  • Monitor for suspicious activity.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-04-06T18:16:44.003Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability affects Vim versions prior to 9.2.0280. Users should verify their deployments and review the official advisory for affected scope and severity. The CVE record provides details on the vulnerability, including its CVSS score and affected versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35177 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35177

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35177 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35177

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.