Vim vulnerable to potential data loss with zip.vim and special crafted zip files

Vulnerability

Vim versions prior to 9.1.1198 are vulnerable to an argument injection flaw in the zip.vim plugin (CVE-2025-29768). The plugin passes user-controlled member-filenames directly to the unzip command without proper sanitization. An attacker can craft a zip archive containing a file with a name starting with -, such as -d/tmp, which is interpreted by unzip as an option argument rather than a filename. This causes unzip to extract the entire archive into a directory chosen by the attacker, potentially overwriting files. The issue arises because unzip version 6.0 (common on many systems) does not support a -- end-of-arguments marker, preventing easy mitigation at the command line. The fix was included in Vim patch v9.1.1198 [1][2].

Exploitation

An attacker must convince a user to open a specially crafted zip archive in Vim using the zip.vim plugin (e.g., by opening the archive file with Vim or using :e on the zip). Once the archive is loaded, the user must press x on the listed member file that has a name like -d/tmp (or similar). The plugin then constructs a command such as unzip -o <archive.zip> -d/tmp, which unzip interprets as a request to extract all files into /tmp. No additional authentication or special network position is required beyond social engineering the user into performing these actions [1].

Impact

Successful exploitation allows an attacker to cause extraction of the entire zip archive into an arbitrary directory on the victim's filesystem, potentially overwriting existing files. This can lead to data loss or unintended file replacement, depending on the extracted content and the destination directory. The vulnerability affects the confidentiality and integrity of user data, though the attacker does not gain code execution or elevated privileges directly [1].

Mitigation

The vulnerability is fixed in Vim version 9.1.1198, released March 11, 2025. Users should update Vim to this version or later. The fix adds a substitution in zip.vim that prepends [-] to filenames starting with a -, preventing them from being interpreted as arguments by unzip [2]. There is no practical workaround for users of unzip 6.0, as the -- option is not supported; upgrading Vim is the recommended action. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of publication [1].