CVE-2025-53905

What it actually does

Path traversal in the tar.vim plugin permits writing files to arbitrary locations outside the archive's intended directory when a malicious tar archive is opened.

Why it matters to the business

Users risk system compromise or data loss if crafted archives overwrite critical files or plant executables in privileged locations, though direct user interaction is required.

How an attack unfolds

An attacker creates a tar archive containing filenames with traversal sequences such as ../. When the victim opens the archive in Vim, the tar.vim plugin extracts and overwrites target files; if permissions allow, planted code in startup locations or PATH directories can enable arbitrary command execution.

How to fix it

Upgrade to Vim 9.1.1552 or apply the patch at commit 87757c6b0a4b2c1f71c72ea8e1438b8fb116b239. Do not open untrusted tar archives with Vim until the update is applied.

How to confirm the fix worked

Verify the installed Vim version is 9.1.1552 or newer and confirm the tar.vim plugin rejects traversal paths during extraction of test archives.

Typical attack path

1. Create tar archive with path traversal filenames targeting sensitive or executable locations
2. Distribute the archive to the victim
3. Victim opens the archive using Vim
4. tar.vim plugin performs unintended file writes
5. Attacker achieves persistence or code execution via overwritten files

How to detect it

Review file access and modification logs around Vim sessions that handle tar archives for writes outside expected directories; inspect recently created or altered files in system or user home paths after tar editing activity.

What your security team should do

• Apply the fixed Vim version or commit immediately across all installations
• Restrict opening of untrusted archives in Vim via policy or sandboxing
• Educate users to inspect archive contents before editing with Vim