Directory Traversal Vulnerability in Notepad++ by Notepad++
CVE-2026-52886

5.1MEDIUM

Key Information:

Vendor

Notepad-plus-plus

Status
Notepad-plus-plus
Vendor
CVE Published:
17 August 2026

What is CVE-2026-52886?

Notepad++ prior to version 8.9.7 contains a directory traversal vulnerability due to insufficient validation of the backupFilePath attribute from the session.xml file. This flaw allows attackers to exploit parent-directory sequences during snapshot-mode restoration, enabling access to arbitrary user-readable files outside the designated backup directory. Prompt updating to version 8.9.7 is highly recommended to mitigate this risk.

Affected Version(s)

notepad-plus-plus < 8.9.7

References

https://github.com/notepad-plus-plus/notepad-plus-plus/se...
x_refsource_CONFIRM
https://github.com/notepad-plus-plus/notepad-plus-plus/co...
x_refsource_MISC
https://github.com/notepad-plus-plus/notepad-plus-plus/re...
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.