View at Official alpine advisory, NVD, CVE.org · CVE detail
Freshness: no update timestamp found; verify against the upstream OS advisory manually.
CVE-2026-35177: 1 source package rows (vim); 336 state rows across 7 repos (3.19-main, 3.20-main, 3.21-main, 3.22-main, 3.23-main, edge-community, edge-main); fixed 2, open 334.
Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives, circumventing the previous fix for CVE-2025-53906. This vulnerability is fixed in 9.2.0280.