Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.
Conclusion & alert: CVE-2025-53905 is rated Exploit Available (50/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.07%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-11 | 0.01% | 0.07% | +0.07% |
| 2 | 2025-07-16 | — | 0.01% | — |
Full EPSS history (2 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 4.1 | 3.1 | MEDIUM |
|
1.0 | 2.7 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
medium | CVE-2025-53905: 1 source package rows (vim); 229 state rows across 5 repos (3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 0, open 229. | https://security.alpinelinux.org/vuln/CVE-2025-53905 |
debian
|
not yet assigned | CVE-2025-53905 not yet assigned priority: Debian including 1 source packages (vim), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 3, resolved 2. | https://security-tracker.debian.org/tracker/CVE-2025-53905 |
gentoo
|
high | CVE-2025-53905: 1 GLSA(s) (202601-02), 3 atom(s) (app-editors/gvim, app-editors/vim, app-editors/vim-core); latest impact high. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2025-53905 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2025-53905 |
suse
|
medium | CVE-2025-53905 severity moderate: SUSE including 311 source package names (13.2-9.33:libsystemd0-254.24-1.1, 13.2-9.33:libudev1-254.24-1.1, …), 923 product×package rows across 304 product lines (Container suse/manager/5.0/x86_64/server, Container suse/multi-linux-manager/5.1/x86_64/server, … (304 product lines)): Fixed 697, Known Affected 226. | https://www.suse.com/security/cve/CVE-2025-53905/ |
ubuntu
|
medium | CVE-2025-53905 medium priority: Ubuntu including 1 source packages (vim), 8 status rows across 8 suites (bionic, focal, jammy, noble, plucky, trusty, upstream, xenial): ignored 5, released 2, needs-triage 1. | https://ubuntu.com/security/CVE-2025-53905 |