CVE-2026-35177 is a vulnerability in the zip.vim plugin of Vim (Vi IMproved) that permits arbitrary file overwrite via a path traversal bypass. This flaw allows an attacker to manipulate file paths to overwrite files outside the intended directory. The issue affects Vim versions prior to 9.2.0280. Red Hat has released security updates for their Enterprise Linux distributions (versions 8 and 10) to address this vulnerability. The vulnerability is rated as moderate severity by Red Hat Product Security. No exploits in the wild are currently known.

An attacker exploiting this vulnerability could overwrite arbitrary files on the system by leveraging the path traversal flaw in the zip.vim plugin. This could lead to unauthorized modification of files, potentially impacting system integrity or user data. However, there are no known exploits in the wild at this time.

Official patches are available from Red Hat for affected versions of Red Hat Enterprise Linux 8 and 10. Users should apply these updates promptly as described in the Red Hat advisories (RHSA-2026:22711 and RHSA-2026:22730). For other distributions or Vim installations, upgrading to Vim version 9.2.0280 or later will mitigate this vulnerability. No additional mitigation steps are indicated by the vendor advisories.