Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.
総合評価: CVE-2025-53905 は公開エクスプロイトあり（50/100）。CVSS 深刻度は中。悪用される可能性が高い（EPSS 0.24%、15 パーセンタイル） 根拠: 公開エクスプロイトが 1 件参照されています（Exploit-DB）。 推奨対応: 公開エクスプロイトが確認されています。影響範囲の確認、緩和策の適用、パッチ適用を優先してください。
リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。
| EDB-ID | ソース | 種別 | 公開 | リンク |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。
| # | 日付 | 旧 EPSS スコア | 新 EPSS スコア | Δ（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.07% | 0.24% | +0.17% |
| 2 | 2026-05-11 | 0.01% | 0.07% | +0.07% |
| 3 | 2025-07-16 | — | 0.01% | — |
EPSS の全履歴 （全 3 件）
この CVE の CVSS 指標。
| ベーススコア | バージョン | 深刻度 | ベクトル | 悪用しやすさ | 影響 | スコアの出典 |
|---|---|---|---|---|---|---|
| 4.1 | 3.1 | MEDIUM |
|
1.0 | 2.7 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
medium | CVE-2025-53905: 1 source package rows (vim); 229 state rows across 5 repos (3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 0, open 229. | https://security.alpinelinux.org/vuln/CVE-2025-53905 |
debian
|
not yet assigned | CVE-2025-53905 not yet assigned priority: Debian including 1 source packages (vim), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 3, resolved 2. | https://security-tracker.debian.org/tracker/CVE-2025-53905 |
gentoo
|
high | CVE-2025-53905: 1 GLSA(s) (202601-02), 3 atom(s) (app-editors/gvim, app-editors/vim, app-editors/vim-core); latest impact high. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2025-53905 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2025-53905 |
suse
|
medium | CVE-2025-53905 severity moderate: SUSE including 311 source package names (13.2-9.33:libsystemd0-254.24-1.1, 13.2-9.33:libudev1-254.24-1.1, …), 923 product×package rows across 304 product lines (Container suse/manager/5.0/x86_64/server, Container suse/multi-linux-manager/5.1/x86_64/server, … (304 product lines)): Fixed 697, Known Affected 226. | https://www.suse.com/security/cve/CVE-2025-53905/ |
ubuntu
|
medium | CVE-2025-53905 medium priority: Ubuntu including 1 source packages (vim), 8 status rows across 8 suites (bionic, focal, jammy, noble, plucky, trusty, upstream, xenial): ignored 5, released 2, needs-triage 1. | https://ubuntu.com/security/CVE-2025-53905 |