CVE-2026-35177
Published: 06 April 2026
Summary
CVE-2026-35177 is a medium-severity Path Traversal (CWE-22) vulnerability in Vim Vim. Its CVSS base score is 4.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 3.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-35177 by requiring timely flaw remediation through patching Vim to version 9.2.0280 or later.
Identifies vulnerable Vim installations affected by CVE-2026-35177 through regular vulnerability scanning of system software.
Reduces exploitation risk of the zip.vim path traversal by prohibiting or restricting non-essential functionality like ZIP archive processing.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables arbitrary file overwrite via user opening crafted ZIP in Vim (T1204.002 Malicious File); directly facilitates stored data manipulation through file overwrites (T1565.001).
NVD Description
Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives, circumventing the previous fix for CVE-2025-53906. This vulnerability is…
more
fixed in 9.2.0280.
Deeper analysisAI
CVE-2026-35177 is a path traversal vulnerability in the zip.vim plugin of Vim, an open source command-line text editor. Versions of Vim prior to 9.2.0280 are affected, where the flaw allows attackers to bypass a previous mitigation for CVE-2025-53906. By opening specially crafted ZIP archives in Vim, arbitrary files on the system can be overwritten. The vulnerability is rated with a CVSS v3.1 base score of 4.1 (AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L) and is associated with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
A local attacker with no privileges can exploit this vulnerability by tricking a user into opening a malicious ZIP archive using Vim. The attack requires high complexity and user interaction, but successful exploitation enables overwriting of arbitrary files, potentially leading to low-impact integrity and availability disruptions with changed scope.
The Vim project has addressed this issue in version 9.2.0280. Additional details are available in the GitHub security advisory at https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24.
Details
- CWE(s)