The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
Conclusion & alert: CVE-2008-3075 is rated High Exploit Risk (82.8/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 4.26%). Core evidence: 2 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ | |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 5.06% | 4.26% | -0.80% |
| 2 | 2025-03-30 | 5.55% | 5.06% | -0.49% |
| 3 | 2025-03-29 | — | 5.55% | — |
Full EPSS history (8 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.3 | 2.0 | HIGH |
|
8.6 | 10.0 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2008-3075 not yet assigned priority: Debian including 1 source packages (vim), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2008-3075 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2008-3075 |
ubuntu
|
medium | CVE-2008-3075 medium priority: Ubuntu including 1 source packages (vim), 5 status rows across 5 suites (dapper, gutsy, hardy, intrepid, upstream): not-affected 4, needs-triage 1. | https://ubuntu.com/security/CVE-2008-3075 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| vim | vim | 7.0 | cpe:2.3:a:vim:vim:7.0:*:*:*:*:*:*:* |
| vim | vim | 7.1 | cpe:2.3:a:vim:vim:7.1:*:*:*:*:*:*:* |
| vim | vim | 7.1.266 | cpe:2.3:a:vim:vim:7.1.266:*:*:*:*:*:*:* |
| vim | vim | 7.1.314 | cpe:2.3:a:vim:vim:7.1.314:*:*:*:*:*:*:* |
| vim | vim | 7.2 | cpe:2.3:a:vim:vim:7.2:*:*:*:*:*:*:* |
| vim | vim | 7.2a.10 | cpe:2.3:a:vim:vim:7.2a.10:*:*:*:*:*:*:* |
| vim | zipplugin.vim | v.11 | cpe:2.3:a:vim:zipplugin.vim:v.11:*:*:*:*:*:*:* |
| vim | zipplugin.vim | v.12 | cpe:2.3:a:vim:zipplugin.vim:v.12:*:*:*:*:*:*:* |
| vim | zipplugin.vim | v.13 | cpe:2.3:a:vim:zipplugin.vim:v.13:*:*:*:*:*:*:* |
| vim | zipplugin.vim | v.14 | cpe:2.3:a:vim:zipplugin.vim:v.14:*:*:*:*:*:*:* |
| vim | zipplugin.vim | v.15 | cpe:2.3:a:vim:zipplugin.vim:v.15:*:*:*:*:*:*:* |
| vim | zipplugin.vim | v.16 | cpe:2.3:a:vim:zipplugin.vim:v.16:*:*:*:*:*:*:* |
| vim | zipplugin.vim | v.17 | cpe:2.3:a:vim:zipplugin.vim:v.17:*:*:*:*:*:*:* |
| vim | zipplugin.vim | v.18 | cpe:2.3:a:vim:zipplugin.vim:v.18:*:*:*:*:*:*:* |
| vim | zipplugin.vim | v.19 | cpe:2.3:a:vim:zipplugin.vim:v.19:*:*:*:*:*:*:* |
| vim | zipplugin.vim | v.20 | cpe:2.3:a:vim:zipplugin.vim:v.20:*:*:*:*:*:*:* |
| vim | zipplugin.vim | v.21 | cpe:2.3:a:vim:zipplugin.vim:v.21:*:*:*:*:*:*:* |