A path traversal bypass in Vim's zip.vim plugin allows an attacker to overwrite arbitrary files when opening specially crafted zip archives. The flaw bypasses a previous fix for a related vulnerability and could enable modification of critical configuration or executable files, potentially leading to system compromise. This weakness is categorized as CWE-22, indicating unsafe handling of file paths.

All installations of Vim using the zip.vim plugin with versions earlier than 9.2.0280 are affected. Updating to version 9.2.0280 or later removes the vulnerability for all vendors listed.

The CVSS score of 4.1 indicates medium severity. No EPSS score is available, and the issue is not listed in CISA's KEV catalog. The likely attack vector is local: an adversary supplies a crafted zip file and forces the target to open it with Vim, triggering path traversal and file overwrite. Remote exploitation is not indicated by the description, so exploitation requires local access or the ability to influence the target’s file operations.