Vulnerability in Notepad-Plus-Plus Notepad\+\+
CVE-2026-52884
Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\..\ after a trusted directory prefix passes the check while resolving to an untrusted location. The CVE-2026-48800 patch adds isInTrustedDirectory() validation in Command::run() (RunDlg.cpp) before calling ShellExecute(). This function checks whether the resolved executable path is under a trusted directory. This vulnerability is fixed in 8.9.6.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (9.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 9.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Notepad-Plus-Plus Notepad\+\+ — versions 8.9.6.1
- Notepad-Plus-Plus — versions = 8.9.6.1
Weakness classification (CWE)
References
- github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-p58x-r3… (Exploit, Patch, Vendor Advisory)
- github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d… (Patch)
Frequently asked questions
- What is CVE-2026-52884?
- CVE-2026-52884 is a high-severity vulnerability in Notepad-Plus-Plus Notepad\+\+, classified under CWE-42. CVSS score: 7.8/10. Published 2026-06-26.
- How severe is CVE-2026-52884?
- High severity. CVSS v3 base score is 7.8 out of 10.