Re: [LFS Trac] #4500: vim-9.1.???? (Update before release)

#4500: vim-9.1.???? (Update before release)
-------------------------+-----------------------
 Reporter:  Bruce Dubbs  |       Owner:  lfs-book
     Type:  task         |      Status:  new
 Priority:  normal       |   Milestone:  Hold
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Comment (by Joe Locash):

 {{{
 Path traversal issue with zip.vim and special crafted zip archives in Vim
 < v9.2.0280
 =====================================================================================
 Date: 01.04.2026
 Severity: Low
 CVE: *not yet assigned*
 CWE: Improper Limitation of a Pathname to a Restricted Directory ('Path
 Traversal') (CWE-22)

 ## Summary

 A path traversal bypass in Vim's zip.vim plugin allows overwriting of
 arbitrary
 files when opening specially crafted zip archives, circumventing the
 previous fix
 for CVE-2025-53906.

 ## Description

 Vim includes the zip.vim plugin, which enables viewing and editing of
 files
 within zip archives. A prior fix for CVE-2025-53906 added a check
 rejecting
 archive member paths beginning with `../`. However, that check can be
 bypassed
 by prefixing the traversal with a dummy directory component (e.g.,
 `a/../../../../../../tmp/foobar`). The leading `a/` causes the original
 pattern
 `^[.]\?[.]/` to not match, while the path still escapes the intended
 directory
 after normalization.

 Exploitation requires the same conditions as CVE-2025-53906:

 - The user opens a specially crafted archive in Vim.
 - The user selects and attempts to edit one of the malicious files within
 the archive.
 - Vim writes the file back to disk using `:w`.

 Only after all these steps are performed would Vim overwrite an existing
 file
 outside the intended working directory.

 - Vim does display the full path to be written, so a careful user may
 notice
   suspicious behavior.
 - Standard zip utilities typically do not extract such paths and will warn
 or
   skip them. This issue only affects Vim's internal handling, not the zip
 tool
   itself.

 ## Impact

 Impact is **low** because exploitation requires direct user interaction.
 However, successful exploitation can lead to overwriting sensitive files
 or
 placing executable code in privileged locations, depending on the
 permissions
 of the process editing the archive.

 The victim must edit such a file using Vim, which will reveal the filename
 and file content - a careful user may suspect something suspicious.

 ## Acknowledgements
 The Vim project would like to thank Michał Majchrowicz for identifying the
 vulnerability chain, providing a detailed root cause analysis and
 reproduction
 steps.

 ## References
 The issue has been fixed as of Vim patch
 [v9.2.0280](https://github.com/vim/vim/releases/tag/v9.2.0280).

 - [Commit](https://github.com/vim/vim/commit/7088926316d8d4a7572a242d0765)
 - [GitHub Advisory](https://github.com/vim/vim/security/advisories/GHSA-
 jc86-w7vm-8p24)
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/4500#comment:58>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page