CVE-2008-3076
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute...
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
Exploit likelihood
What each source reports
NVD Score used
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
- Record
CVE-2008-3076- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
- Record
CVE-2008-3076- Updated
- 2026-11-02
EUVDEUVD-2008-3066 No score
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
- Record
EUVD-2008-3066- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f5qf-9pc8-pr89 No score
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute...
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
- Record
GHSA-f5qf-9pc8-pr89- Weakness
- CWE-78
- Updated
- 2026-11-02
OSV No score
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
- Record
CVE-2008-3076- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-3076 No score
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
- Record
DEBIAN-CVE-2008-3076- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vimDebian:12 |
before 2:7.2.010-1 | 2:7.2.010-1 |
vimDebian:13 |
before 2:7.2.010-1 | 2:7.2.010-1 |
vimDebian:14 |
before 2:7.2.010-1 | 2:7.2.010-1 |
vimDebian:4.0 From an advisory covering 5 CVEs |
before 1:7.0-122+1etch5, plus listed versions 1:7.0-122+1etch21:7.0-122+1etch31:7.0-122+1etch4 |
1:7.0-122+1etch5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Netrw 125 Vim Script - Multiple Command Execution Vulnerabilities | 2008-07-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3076 is a high vulnerability (CVSS 9.3) in Vim, published February 21, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.02%, the 95th percentile. Fixed in vim 2:7.2.010-1.
References
lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
marc.info?l=oss-security&m=122416184431388&w=2
openwall.com/lists/oss-security/2008/10/20/2
rdancer.org/vulnerablevim-netrw.html
redhat.com/support/errata/RHSA-2008-0580.html
secunia.com/advisories/34418
Show 13 moreShow less
securityfocus.com/bid/30115
wiki.rpath.com/wiki/Advisories:rPSA-2008-0324
bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919
exchange.xforce.ibmcloud.com/vulnerabilities/43624
mandriva.com/security/advisories?name=MDVSA-2008:236
nvd.nist.gov/vuln/detail/CVE-2008-3076
github.com/advisories/GHSA-f5qf-9pc8-pr89
security-tracker.debian.org/tracker/CVE-2008-3076