The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a tar archive and possibly (2) the filename of the first file in a tar archive, which is not properly handled by the VIM TAR plugin (tar.vim) v.10 through v.22, as demonstrated by the shellescape, tarplugin.v2, tarplugin, and tarplugin.updated test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3075. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
Conclusion & alert: CVE-2008-3074 is rated High Exploit Risk (84.4/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 3.84%). Core evidence: 2 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +1.16% over the last day, indicating growing attacker interest. Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ | |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 2.68% | 3.84% | +1.16% |
| 2 | 2025-03-30 | 3.50% | 2.68% | -0.82% |
| 3 | 2025-03-29 | — | 3.50% | — |
Full EPSS history (7 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.3 | 2.0 | HIGH |
|
8.6 | 10.0 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2008-3074 not yet assigned priority: Debian including 1 source packages (vim), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2008-3074 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2008-3074 |
ubuntu
|
medium | CVE-2008-3074 medium priority: Ubuntu including 1 source packages (vim), 5 status rows across 5 suites (dapper, gutsy, hardy, intrepid, upstream): not-affected 4, needs-triage 1. | https://ubuntu.com/security/CVE-2008-3074 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| vim | tar.vim | v.10 | cpe:2.3:a:vim:tar.vim:v.10:*:*:*:*:*:*:* |
| vim | tar.vim | v.11 | cpe:2.3:a:vim:tar.vim:v.11:*:*:*:*:*:*:* |
| vim | tar.vim | v.12 | cpe:2.3:a:vim:tar.vim:v.12:*:*:*:*:*:*:* |
| vim | tar.vim | v.13 | cpe:2.3:a:vim:tar.vim:v.13:*:*:*:*:*:*:* |
| vim | tar.vim | v.14 | cpe:2.3:a:vim:tar.vim:v.14:*:*:*:*:*:*:* |
| vim | tar.vim | v.15 | cpe:2.3:a:vim:tar.vim:v.15:*:*:*:*:*:*:* |
| vim | tar.vim | v.16 | cpe:2.3:a:vim:tar.vim:v.16:*:*:*:*:*:*:* |
| vim | tar.vim | v.17 | cpe:2.3:a:vim:tar.vim:v.17:*:*:*:*:*:*:* |
| vim | tar.vim | v.18 | cpe:2.3:a:vim:tar.vim:v.18:*:*:*:*:*:*:* |
| vim | tar.vim | v.19 | cpe:2.3:a:vim:tar.vim:v.19:*:*:*:*:*:*:* |
| vim | tar.vim | v.20 | cpe:2.3:a:vim:tar.vim:v.20:*:*:*:*:*:*:* |
| vim | tar.vim | v.21 | cpe:2.3:a:vim:tar.vim:v.21:*:*:*:*:*:*:* |
| vim | tar.vim | v.22 | cpe:2.3:a:vim:tar.vim:v.22:*:*:*:*:*:*:* |
| vim | vim | 7.0 | cpe:2.3:a:vim:vim:7.0:*:*:*:*:*:*:* |
| vim | vim | 7.1 | cpe:2.3:a:vim:vim:7.1:*:*:*:*:*:*:* |
| vim | vim | 7.1.266 | cpe:2.3:a:vim:vim:7.1.266:*:*:*:*:*:*:* |
| vim | vim | 7.1.314 | cpe:2.3:a:vim:vim:7.1.314:*:*:*:*:*:*:* |
| vim | vim | 7.2 | cpe:2.3:a:vim:vim:7.2:*:*:*:*:*:*:* |