CVE-2026-52886
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Notepad++ before 8.9.7 validates the backupFilePath attribute from session.xml with std::wstring::starts_with against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode restoration to read an arbitrary user-readable file outside the backup directory into an editor tab.
Risk Assessment
The risk includes reading sensitive local files that may be visible in the editor, potentially leading to data disclosure.
Recommendation
It is recommended to upgrade to version 8.9.7 or later, which includes the fix.
Original NVD description (English source)
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts_with against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode restoration to read an arbitrary user-readable file outside the backup directory into an editor tab. This issue is fixed in version 8.9.7.