Read the docs
TI-2008-02943 Aliases CVE-2008-3075GHSA-wqmg-q854-x6x6

The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted…

Priority MEDIUM 47CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-94.

Summary

The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.

Why it matters now

EPSS 0.04258 91st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:vim:vim:7.0:*:*:*:*:*:*:*7.0Vulnerablevim
cpe:2.3:a:vim:vim:7.1:*:*:*:*:*:*:*7.1Vulnerablevim
cpe:2.3:a:vim:vim:7.1.266:*:*:*:*:*:*:*7.1.266Vulnerablevim
cpe:2.3:a:vim:vim:7.1.314:*:*:*:*:*:*:*7.1.314Vulnerablevim
cpe:2.3:a:vim:vim:7.2:*:*:*:*:*:*:*7.2Vulnerablevim
cpe:2.3:a:vim:vim:7.2a.10:*:*:*:*:*:*:*7.2a.10Vulnerablevim
cpe:2.3:a:vim:zipplugin.vim:v.11:*:*:*:*:*:*:*v.11Vulnerablevim
cpe:2.3:a:vim:zipplugin.vim:v.12:*:*:*:*:*:*:*v.12Vulnerablevim
cpe:2.3:a:vim:zipplugin.vim:v.13:*:*:*:*:*:*:*v.13Vulnerablevim
cpe:2.3:a:vim:zipplugin.vim:v.14:*:*:*:*:*:*:*v.14Vulnerablevim
  • cpe:2.3:a:vim:vim:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·vim
  • cpe:2.3:a:vim:vim:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·vim
  • cpe:2.3:a:vim:vim:7.1.266:*:*:*:*:*:*:* Versions 7.1.266 Vulnerable ·vim
  • cpe:2.3:a:vim:vim:7.1.314:*:*:*:*:*:*:* Versions 7.1.314 Vulnerable ·vim
  • cpe:2.3:a:vim:vim:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·vim
  • cpe:2.3:a:vim:vim:7.2a.10:*:*:*:*:*:*:* Versions 7.2a.10 Vulnerable ·vim
  • cpe:2.3:a:vim:zipplugin.vim:v.11:*:*:*:*:*:*:* Versions v.11 Vulnerable ·vim
  • cpe:2.3:a:vim:zipplugin.vim:v.12:*:*:*:*:*:*:* Versions v.12 Vulnerable ·vim
  • cpe:2.3:a:vim:zipplugin.vim:v.13:*:*:*:*:*:*:* Versions v.13 Vulnerable ·vim
  • cpe:2.3:a:vim:zipplugin.vim:v.14:*:*:*:*:*:*:* Versions v.14 Vulnerable ·vim
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vim:zipplugin.vim:v.15:*:*:*:*:*:*:*v.15Vulnerablevim
cpe:2.3:a:vim:zipplugin.vim:v.16:*:*:*:*:*:*:*v.16Vulnerablevim
cpe:2.3:a:vim:zipplugin.vim:v.17:*:*:*:*:*:*:*v.17Vulnerablevim
cpe:2.3:a:vim:zipplugin.vim:v.18:*:*:*:*:*:*:*v.18Vulnerablevim
cpe:2.3:a:vim:zipplugin.vim:v.19:*:*:*:*:*:*:*v.19Vulnerablevim
cpe:2.3:a:vim:zipplugin.vim:v.20:*:*:*:*:*:*:*v.20Vulnerablevim
cpe:2.3:a:vim:zipplugin.vim:v.21:*:*:*:*:*:*:*v.21Vulnerablevim
  • cpe:2.3:a:vim:zipplugin.vim:v.15:*:*:*:*:*:*:* Versions v.15 Vulnerable ·vim
  • cpe:2.3:a:vim:zipplugin.vim:v.16:*:*:*:*:*:*:* Versions v.16 Vulnerable ·vim
  • cpe:2.3:a:vim:zipplugin.vim:v.17:*:*:*:*:*:*:* Versions v.17 Vulnerable ·vim
  • cpe:2.3:a:vim:zipplugin.vim:v.18:*:*:*:*:*:*:* Versions v.18 Vulnerable ·vim
  • cpe:2.3:a:vim:zipplugin.vim:v.19:*:*:*:*:*:*:* Versions v.19 Vulnerable ·vim
  • cpe:2.3:a:vim:zipplugin.vim:v.20:*:*:*:*:*:*:* Versions v.20 Vulnerable ·vim
  • cpe:2.3:a:vim:zipplugin.vim:v.21:*:*:*:*:*:*:* Versions v.21 Vulnerable ·vim

Remediation

Red Hat 1 advisory

  • RHSA-2008:0580 Released 2008-11-25 · Red Hat rating Moderate
    vim security update
    • Red Hat Enterprise Linux (v. 5 server) vim-2:7.0.109-4.el5_2.4z, vim-X11-2:7.0.109-4.el5_2.4z, vim-X11-2:7.0.109-4.el5_2.4z.i386 +14
    • Red Hat Enterprise Linux Desktop (v. 5 client) vim-2:7.0.109-4.el5_2.4z, vim-X11-2:7.0.109-4.el5_2.4z, vim-X11-2:7.0.109-4.el5_2.4z.i386 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2008:0580
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2008:0580

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-3075
  2. 2026-10-03 Alias added: GHSA-wqmg-q854-x6x6

References

Exploit 2

Patch 1

Advisory 3

Other 12

  • TI-2022-03248 Heap-based Buffer Overflow in vim/vim CVSS 3.1CRITICAL 9.8
  • TI-2024-15103 Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c… CVSS 3.1HIGH 7.8
  • TI-2023-05093 Use After Free in vim/vim CVSS 3.1HIGH 7.8
  • TI-2023-04407 Heap-based Buffer Overflow in vim/vim CVSS 3.1HIGH 7.8
  • TI-2023-04379 Heap-based Buffer Overflow in vim/vim CVSS 3.1HIGH 7.8
  • TI-2023-04378 Use After Free in vim/vim CVSS 3.1HIGH 7.8
See all 258 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences