notepad-plus-plus Notepad++ 8.9.6.1 RunDlg.cpp isInTrustedDirectory path equivalence

Summaryinfo

A vulnerability identified as critical has been detected in notepad-plus-plus Notepad++ 8.9.6.1. Affected is the function isInTrustedDirectory of the file RunDlg.cpp. Performing a manipulation results in path equivalence. This vulnerability is cataloged as CVE-2026-52884. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in notepad-plus-plus Notepad++ 8.9.6.1. This affects the function isInTrustedDirectory of the file RunDlg.cpp. The manipulation with an unknown input leads to a path equivalence vulnerability. CWE is classifying the issue as CWE-42. The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\..\ after a trusted directory prefix passes the check while resolving to an untrusted location. The CVE-2026-48800 patch adds isInTrustedDirectory() validation in Command::run() (RunDlg.cpp) before calling ShellExecute(). This function checks whether the resolved executable path is under a trusted directory. This vulnerability is fixed in 8.9.6.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-52884 since 06/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading to version 8.9.6.1 or 8.9.6.2 eliminates this vulnerability. Applying the patch ea1508855e9c4528f6198ce9d345f13cb759ebf4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Document Reader Software

Vendor

• notepad-plus-plus

Name

• Notepad++

Version

• 8.9.6.1

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion