CVE-2025-29768

What it actually does

Path traversal in zip.vim allows a specially crafted zip archive to cause data loss when a user views the archive and presses 'x' on a malicious filename, enabling unintended file deletion or overwrite outside the extraction directory.

Why it matters to the business

Users risk losing important files if they open a malicious zip archive in Vim and interact with unusual filenames, potentially disrupting work and requiring data recovery efforts; low urgency given stable low exploit likelihood and no known campaigns.

How an attack unfolds

An attacker creates a zip file embedding path traversal sequences in a filename. The victim is tricked into opening the archive with Vim, then presses 'x' on the crafted entry, triggering the vulnerability to delete or corrupt files on the system.

How to fix it

Update Vim to a version containing commit f209dcd3defb95bae21b2740910e6aa7bb940531 (corresponding to patch v9.1.1198 or later) to resolve the path traversal issue in zip.vim.

How to confirm the fix worked

Verify the installed Vim version includes commit f209dcd3defb95bae21b2740910e6aa7bb940531 or is at least 9.1.1198; test by attempting to open a crafted zip and confirming no traversal occurs on 'x' press.

Typical attack path

1. Craft a zip archive containing a filename with path traversal sequences
2. Distribute the archive to the target user
3. Victim opens the archive using Vim
4. Victim navigates to and presses 'x' on the malicious filename entry
5. Arbitrary file deletion or overwrite occurs outside the intended scope

How to detect it

Review Vim process logs and file system audit trails for unexpected deletions or writes triggered after zip archive access; check for any unusual filename patterns in zip handling events.

What your security team should do

• Prioritize patching Vim installations to the fixed commit across all environments
• Educate users on avoiding interaction with untrusted zip files in Vim
• Monitor for any new exploit activity given the path traversal family classification