CVE-2026-57233 in Notepad++
Summary
by MITRE • 08/17/2026
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
Notepad++ is a widely used free and open-source source code editor for Microsoft Windows, known for its extensive plugin architecture which allows users to extend functionality through dynamically loaded libraries. The vulnerability described pertains specifically to the application's automatic update mechanism, implemented via WinGup, rather than the core editing engine itself. This component is responsible for downloading updates from official servers and installing them into the local directory structure. In versions prior to 8.9.7, a critical flaw existed within the decompression logic used when processing ZIP archives containing these updates or potentially malicious payloads disguised as update packages.
The technical root cause of this vulnerability lies in improper path canonicalization during the extraction process. When WinGup receives a ZIP archive, it iterates through each entry and determines where to extract the file based on the provided destination directory, referred to internally as unzipDestTo. However, the implementation fails to validate whether the extracted file paths remain within the intended target directory boundaries. Specifically, if an attacker constructs a malicious ZIP archive containing entries with relative path traversal sequences such as ../mimeTools/mimeTools.dll, the decompression function will resolve these paths by moving up one or more directories from the current extraction point. This allows files to be written outside of the designated update folder and into sibling directories within the Notepad++ installation tree.
This lack of containment validation directly enables a DLL preloading attack scenario with significant operational impact. By overwriting legitimate dynamic-link libraries located in plugin directories, such as mimeTools.dll or other critical components, an attacker can inject malicious code that will be executed by Notepad++ during its next startup sequence. Since the application loads these plugins automatically upon launch, any user who opens a crafted ZIP file—whether through direct interaction with a phishing attachment or via automated processes like email clients previewing attachments—may inadvertently trigger the execution of arbitrary code under their current user privileges. This represents a severe security risk as it bypasses traditional sandboxing expectations and allows for full system compromise if the application is run with elevated permissions, though even standard user access can lead to data theft or further lateral movement within a compromised environment.
From an industry standards perspective, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The failure to ensure that extracted files remain within the expected directory structure is a classic example of insufficient input validation regarding file system operations. Furthermore, in the context of the MITRE ATT&CK framework, this technique maps to T1059: Command and Scripting Interpreter through DLL preloading or side-loading, where attackers leverage legitimate software features to execute malicious code. The attack vector also relates to T1204: User Execution, as it relies on the victim opening a specific file type that triggers the vulnerable update mechanism.
Mitigation for this issue is straightforward and primarily involves updating Notepad++ to version 8.9.7 or later, where the developers have implemented proper canonicalization checks to prevent path traversal during ZIP extraction. Organizations should enforce strict software update policies to ensure all endpoints are running patched versions of frequently used applications like text editors. Additionally, users should exercise caution when opening ZIP files from untrusted sources, as these archives may contain maliciously crafted entries designed to exploit such vulnerabilities. Security awareness training emphasizing the risks associated with automatic updates and plugin loading mechanisms can further reduce the likelihood of successful exploitation in environments where manual patching is not immediately feasible.