CVE-2026-52884 Overview
CVE-2026-52884 is a path traversal vulnerability in Notepad++ version 8.9.6.1. The isInTrustedDirectory() function fails to canonicalize file paths before validating them against trusted directory locations. It relies on a prefix-based check using PathIsPrefix() (or an equivalent routine) that matches any path starting with a trusted directory string. An attacker can append ..\..\ sequences after a legitimate trusted prefix to bypass the check while resolving execution to an untrusted location. The flaw is categorized as [CWE-42] (Path Equivalence). Notepad++ 8.9.6.2 addresses the issue.
Critical Impact
The bypass defeats the trusted-directory check introduced by the CVE-2026-48800 patch, allowing execution of executables from untrusted paths via ShellExecute() invoked in Command::run().
Affected Products
- Notepad++ 8.9.6.1
- RunDlg.cpp component (Command::run() calling ShellExecute())
- Fixed in Notepad++ 8.9.6.2
Discovery Timeline
- 2026-06-26 - CVE-2026-52884 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-52884
Vulnerability Analysis
The vulnerability resides in isInTrustedDirectory(), a validation function added by the CVE-2026-48800 patch. That patch placed the check inside Command::run() in RunDlg.cpp immediately before ShellExecute() is invoked. The intent was to confirm that any executable launched through the Run dialog resolves to a directory the application trusts. However, the check operates on the raw path string without first normalizing it. Because the comparison is a prefix match, a path such as C:\TrustedDir\..\..\Untrusted\evil.exe satisfies the prefix condition while resolving to an entirely different location on disk. An attacker who can influence the Run command target, for example through a tampered shortcuts.xml file, can trigger execution of an arbitrary executable outside trusted directories.
Root Cause
The root cause is missing path canonicalization prior to a prefix-based access decision. The function does not call an API such as GetFullPathNameW() or PathCanonicalize() to resolve .. and . components before comparing against the trusted directory list.
Attack Vector
Exploitation requires local access and user interaction, consistent with the tampering scenario. An attacker modifies configuration data referenced by Notepad++ (such as shortcuts.xml) so the Run command target begins with a trusted directory prefix followed by traversal sequences. When the user triggers the command, isInTrustedDirectory() returns true and ShellExecute() runs the attacker-controlled binary.
// Patch excerpt: linker adds bcrypt for integrity verification of shortcuts.xml
LD := $(CXX)
LDFLAGS := -municode -mwindows
LD_PATH :=
-LD_LINK := comctl32 crypt32 dbghelp ole32 sensapi shlwapi uuid uxtheme version wininet wintrust dwmapi
+LD_LINK := comctl32 crypt32 dbghelp ole32 sensapi shlwapi uuid uxtheme version wininet wintrust dwmapi bcrypt
LD_LINK += $(patsubst lib%.a,%,$(SCINTILLA_TARGET)) $(patsubst lib%.a,%,$(LEXILLA_TARGET)) imm32 msimg32 ole32 oleaut32
Source: GitHub Commit ea150885
Detection Methods for CVE-2026-52884
Indicators of Compromise
- Modifications to shortcuts.xml in the Notepad++ configuration directory containing paths with ..\..\ traversal sequences after a trusted directory prefix.
- notepad++.exe spawning child processes from locations outside standard trusted directories such as Program Files\Notepad++ or the user's install path.
- Unexpected ShellExecute() invocations targeting binaries in %TEMP%, %APPDATA%, or user-writable directories.
Detection Strategies
- Monitor process creation events where the parent image is notepad++.exe and the child image path resides outside expected trusted directories.
- Alert on command-line arguments passed to notepad++.exe Run commands that contain traversal patterns such as ..\..\.
- Track file writes to Notepad++ configuration files by processes other than notepad++.exe itself.
Monitoring Recommendations
- Enable process command-line logging (Windows Event ID 4688 with command line auditing, or Sysmon Event ID 1) on endpoints running Notepad++.
- Baseline Notepad++ child-process behavior and flag deviations, particularly executables launched from user-writable directories.
- Ingest endpoint process telemetry into a centralized data lake for cross-host correlation of anomalous Notepad++ execution chains.
How to Mitigate CVE-2026-52884
Immediate Actions Required
- Upgrade all Notepad++ installations to version 8.9.6.2 or later.
- Audit shortcuts.xml and other Notepad++ configuration files for entries containing ..\ sequences or paths pointing outside expected directories.
- Restrict write permissions on Notepad++ configuration directories to the owning user only and prevent tampering by lower-privileged processes.
Patch Information
The fix landed in commit ea1508855e9c4528f6198ce9d345f13cb759ebf4 and is included in Notepad++ 8.9.6.2. The patch adds integrity verification of shortcuts.xml (linking bcrypt for cryptographic operations) and removes the previously exposed run-security warning strings that indicated the unhardened flow. Refer to the GitHub Security Advisory GHSA-p58x-r3c9-x9p6 for full details.
Workarounds
- Avoid using the Run command feature in Notepad++ 8.9.6.1 until the upgrade is applied.
- Deploy application allowlisting (such as Windows Defender Application Control or AppLocker) to restrict which binaries notepad++.exe can launch.
- Remove or set read-only permissions on shortcuts.xml where the Run feature is not required in the environment.
# Verify installed Notepad++ version on Windows via PowerShell
(Get-Item "C:\Program Files\Notepad++\notepad++.exe").VersionInfo.ProductVersion
# Set shortcuts.xml to read-only to block tampering
attrib +R "%APPDATA%\Notepad++\shortcuts.xml"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
