Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Red Hat vim packages could write files outside intended folder
published 14 days ago
Summary
The vim editor’s zip handling feature may be tricked into creating or modifying files outside the intended archive directory. This could let an attacker place malicious files on your system when a crafted zip file is opened. Update your vim packages to the latest Red Hat release that includes the fix.
What to do
- Update redhat vim-x11 to version 2:7.4.629-8.0.3.el7_9.tuxcare.els5.
- Update redhat vim-common to version 2:7.4.629-8.0.3.el7_9.tuxcare.els5.
- Update redhat vim-enhanced to version 2:7.4.629-8.0.3.el7_9.tuxcare.els5.
- Update redhat vim-filesystem to version 2:7.4.629-8.0.3.el7_9.tuxcare.els5.
- Update redhat vim-minimal to version 2:7.4.629-8.0.3.el7_9.tuxcare.els5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:RHEL:7 | redhat | vim-x11 |
< 2:7.4.629-8.0.3.el7_9.tuxcare.els5 Fix: upgrade to 2:7.4.629-8.0.3.el7_9.tuxcare.els5
|
| TuxCare:RHEL:7 | redhat | vim-common |
< 2:7.4.629-8.0.3.el7_9.tuxcare.els5 Fix: upgrade to 2:7.4.629-8.0.3.el7_9.tuxcare.els5
|
| TuxCare:RHEL:7 | redhat | vim-enhanced |
< 2:7.4.629-8.0.3.el7_9.tuxcare.els5 Fix: upgrade to 2:7.4.629-8.0.3.el7_9.tuxcare.els5
|
| TuxCare:RHEL:7 | redhat | vim-filesystem |
< 2:7.4.629-8.0.3.el7_9.tuxcare.els5 Fix: upgrade to 2:7.4.629-8.0.3.el7_9.tuxcare.els5
|
| TuxCare:RHEL:7 | redhat | vim-minimal |
< 2:7.4.629-8.0.3.el7_9.tuxcare.els5 Fix: upgrade to 2:7.4.629-8.0.3.el7_9.tuxcare.els5
|
Original advisory text
vim: Fix of CVE-2026-35177
- CVE-2026-35177: fix path traversal in the zip.vim plugin - reject a write
whose target escapes the archive directory after simplify() normalization
(upstream 9.2.0280)
whose target escapes the archive directory after simplify() normalization
(upstream 9.2.0280)
References
- https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792577361.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-35177 Vendor Advisory
Timeline
Published21 Oct 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1792577361 · OSV
Track software like this
Free during beta