Directory Traversal Vulnerability in Notepad++ Free Code Editor

CVE-2026-77605

What is CVE-2026-77605?

Notepad++, an open-source source code editor, contains a vulnerability in versions before 8.9.8 that allows an attacker to exploit the 'Folder as Workspace Run by system' action. When users select a text file and invoke this feature, the software may inadvertently execute an unintended command script located in the same directory, leading to potential security breaches. Attackers can manipulate this behavior by placing a specially crafted script that matches the name of the selected file with a .cmd extension. This flaw can compromise user systems on Windows 10 and Windows 11, allowing unauthorized script execution instead of the intended file opening. Users are advised to update to version 8.9.8 or later to mitigate this risk.

References