Multiple vulnerabilities were found and fixed in Vim, an enhanced version of the standard UNIX editor Vi (Vi IMproved). A remote attacker could trigger arbitrary code execution, command injection, or a crash (potential memory-corruption) via crafted files, archives, help/tag files, modelines, spell files, or crafted input to the NetBeans interface. CVE-2025-53905 - Path traversal in the tar plugin. The tar plugin did not protect archive member names against ".." traversal. CVE-2025-53906 - Path traversal in the zip plugin. The zip plugin did not protect archive member names against ".." traversal. CVE-2026-25749 - Buffer overflow in 'helpfile' option handling. Overlong help file paths could