{
  "threat_severity" : "Moderate",
  "public_date" : "2025-07-15T20:48:34Z",
  "bugzilla" : {
    "description" : "vim: Vim path traversial",
    "id" : "2380362",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2380362"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-22",
  "details" : [ "Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.", "A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2025-10-14T00:00:00Z",
    "advisory" : "RHSA-2025:17913",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.0",
    "package" : "vim-2:9.1.083-5.el10_0.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2025-11-11T00:00:00Z",
    "advisory" : "RHSA-2025:21015",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.1",
    "package" : "vim-2:9.1.083-6.el10_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-10-09T00:00:00Z",
    "advisory" : "RHSA-2025:17715",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "vim-2:8.0.1763-21.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-10-09T00:00:00Z",
    "advisory" : "RHSA-2025:17715",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "vim-2:8.0.1763-21.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-10-13T00:00:00Z",
    "advisory" : "RHSA-2025:17742",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "vim-2:8.2.2637-22.el9_6.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-11-11T00:00:00Z",
    "advisory" : "RHSA-2025:20945",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "vim-2:8.2.2637-23.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-10-13T00:00:00Z",
    "advisory" : "RHSA-2025:17742",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "vim-2:8.2.2637-22.el9_6.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-11-11T00:00:00Z",
    "advisory" : "RHSA-2025:20945",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "vim-2:8.2.2637-23.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-10-09T00:00:00Z",
    "advisory" : "RHSA-2025:17644",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "vim-2:8.2.2637-20.el9_4.1"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2025-12-10T00:00:00Z",
    "advisory" : "RHSA-2025:23078",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/vllm-cuda-rhel9:sha256:bddcf7ab6d576572b6d60822c313ffebcd9869e4fde93e32ac327821f93cf32b"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2025-12-10T00:00:00Z",
    "advisory" : "RHSA-2025:23079",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/vllm-rocm-rhel9:sha256:7856bdb7ae0d643a7b9362c164d4d4fe3c0c7186f5fff73a7ae9835b3df52e57"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2025-12-10T00:00:00Z",
    "advisory" : "RHSA-2025:23080",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/model-opt-cuda-rhel9:sha256:14e32e88f1b89f59ed34a6d712746b82a6a54c6ed4727784f18aeff853abbdc7"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2026-02-27T00:00:00Z",
    "advisory" : "RHSA-2026:3461",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/vllm-cuda-rhel9:sha256:dcb9d1cd005c40b6db6f893e56419e383b9dcc0d38315605cb1457e2af5354f7"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2026-02-27T00:00:00Z",
    "advisory" : "RHSA-2026:3462",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/vllm-rocm-rhel9:sha256:53007894763e03f609c35c727cb738db3c2130b19fa0e1069c24240e0870fb7a"
  }, {
    "product_name" : "Red Hat Discovery 2",
    "release_date" : "2025-10-23T00:00:00Z",
    "advisory" : "RHSA-2025:19088",
    "cpe" : "cpe:/a:redhat:discovery:2::el9",
    "package" : "discovery/discovery-ui-rhel9:sha256:435ba9959b793d46a63a74c343bb8c3ff68350496afec12cc5e894dfc40b7648"
  }, {
    "product_name" : "Red Hat Discovery 2",
    "release_date" : "2025-11-24T00:00:00Z",
    "advisory" : "RHSA-2025:21994",
    "cpe" : "cpe:/a:redhat:discovery:2::el9",
    "package" : "discovery/discovery-ui-rhel9:sha256:310df392f638ef6eca1a26db024ae2cb617db5932f886d2acddc92fb7289e740"
  }, {
    "product_name" : "Red Hat Insights proxy 1.5",
    "release_date" : "2025-11-10T00:00:00Z",
    "advisory" : "RHSA-2025:20066",
    "cpe" : "cpe:/a:redhat:insights_proxy:1.5::el9",
    "package" : "insights-proxy/insights-proxy-container-rhel9:sha256:940f62545101f5cb8799670b2e8b22c0169717ff976be0b7932d48f540048759"
  }, {
    "product_name" : "Red Hat Insights proxy 1.5",
    "release_date" : "2025-12-08T00:00:00Z",
    "advisory" : "RHSA-2025:22868",
    "cpe" : "cpe:/a:redhat:insights_proxy:1.5::el9",
    "package" : "insights-proxy/insights-proxy-container-rhel9:sha256:1d72e553fe5a7696e600dc8fd2fe9050ba1992fa190bea622134ca7bfce7bb0d"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "vim",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "vim",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "rhcos",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-53905\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-53905\nhttps://github.com/vim/vim/commit/87757c6b0a4b2c1f71c72ea8e1438b8fb116b239\nhttps://github.com/vim/vim/security/advisories/GHSA-74v4-f3x9-ppvr" ],
  "name" : "CVE-2025-53905",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}