VULNERABILITY INTELLIGENCE
CVE-2026-52886
EPSS probability0.17%
CISA KEVNot currently listed
Published2026-08-17
Last modified2026-09-09
Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts_with against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode restoration to read an arbitrary user-readable file outside the backup directory into an editor tab. This issue is fixed in version 8.9.7.
Weakness classification
- security-advisories@github.com: CWE-22