CVE-2026-52886: Notepad++ Path Traversal Vulnerability

CVE-2026-52886 Overview

CVE-2026-52886 is a path traversal vulnerability [CWE-22] in Notepad++, the widely used open-source source code editor for Windows. Versions prior to 8.9.7 validate the backupFilePath attribute in session.xml using std::wstring::starts_with against the expected backup directory. The check runs without path normalization, so parent-directory sequences such as ..\ bypass the prefix comparison. During snapshot-mode session restoration, a crafted session.xml causes Notepad++ to open an arbitrary user-readable file into an editor tab. The maintainers fixed the issue in version 8.9.7 by normalizing paths before comparison.

Critical Impact
A local attacker who can write to a user's Notepad++ configuration directory can force the editor to load arbitrary files readable by the user on the next launch.

Affected Products

Notepad++ versions prior to 8.9.7
Notepad++ snapshot-mode session restoration component (PowerEditor/src/Parameters.cpp)
Windows installations relying on session.xml for editor state persistence

Discovery Timeline

2026-08-17 - CVE-2026-52886 published to NVD
2026-08-18 - Last updated in NVD database
v8.9.7 - Notepad++ releases patched version with path normalization

Technical Details for CVE-2026-52886

Vulnerability Analysis

Notepad++ persists open tabs and unsaved buffers to disk through snapshot mode. Session state is written to session.xml, which records each file's original path and a backupFilePath pointing into the Notepad++ backup directory. On startup, the editor iterates session entries and reloads each backupFilePath into a tab.

Before restoring a backup, Notepad++ validates that backupFilePath begins with the expected backup directory. The validation calls std::wstring::starts_with on the raw attribute value. This is a lexical prefix check and does not resolve ..\ traversal sequences, symbolic elements, or mixed separators. An attacker who tampers with session.xml can supply a value like C:\Users\victim\AppData\Roaming\Notepad++\backup\..\..\..\sensitive.txt that passes the prefix test while resolving outside the intended directory.

Exploitation requires local access with the ability to write to the victim's configuration and user interaction to launch Notepad++. The resulting read is bounded by the victim user's file permissions, and the file contents surface inside an editor tab where they may be inadvertently saved, copied, or synchronized.

Root Cause

The root cause is missing path canonicalization prior to a security-relevant comparison. std::wstring::starts_with operates on the literal string, so ..\ sequences embedded after the trusted prefix are never collapsed. Any decision derived from that comparison inherits the same blind spot.

Attack Vector

The attack vector is local. An attacker with write access to the user's Notepad++ configuration directory modifies session.xml and inserts a traversal-laden backupFilePath. When the victim next starts Notepad++ with snapshot mode active, the editor opens the targeted file into a tab.

cpp

// Patch excerpt: PowerEditor/src/Parameters.cpp
#include <shlobj.h>
#include <shlwapi.h>
#include <pathcch.h>
#include <strsafe.h>

#include <algorithm>
#include <array>

The fix introduces <pathcch.h> and links Pathcch.lib, enabling use of Windows PathCchCanonicalize-family APIs to normalize session paths before the prefix check. Source: GitHub commit 7e66f36.

Detection Methods for CVE-2026-52886

Indicators of Compromise

Presence of ..\ or ../ sequences inside the backupFilePath attribute of any session.xml under a user's Notepad++ configuration directory.
backupFilePath values that resolve outside %AppData%\Notepad++\backup\ after canonicalization.
Notepad++ tabs opened at startup referencing files the user did not explicitly open, particularly under %USERPROFILE%, SSH key directories, or browser profile paths.

Detection Strategies

Inspect session.xml files across user profiles for backup paths containing traversal characters or absolute paths outside the sanctioned backup directory.
Monitor process telemetry for notepad++.exe opening file handles to sensitive locations shortly after launch, correlated with recent modifications to session.xml.
Compare the running Notepad++ version to 8.9.7 across managed endpoints and flag older builds for prioritized patching.

Monitoring Recommendations

Enable file integrity monitoring on %AppData%\Notepad++\session.xml and alert on modifications by processes other than notepad++.exe.
Log and review Notepad++ recent-file and session state for unexpected file paths during incident triage.
Track endpoint software inventory to confirm Notepad++ builds remain at 8.9.7 or later.

How to Mitigate CVE-2026-52886

Immediate Actions Required

Upgrade all Notepad++ installations to version 8.9.7 or later using the official GitHub release v8.9.7.
Audit existing session.xml files on developer and analyst workstations and remove entries containing traversal sequences.
Restrict write access to user configuration directories where feasible and investigate any unauthorized modifications.

Patch Information

Notepad++ 8.9.7 addresses the vulnerability by canonicalizing session file paths before the prefix comparison. The patch adds <pathcch.h> and links Pathcch.lib in PowerEditor/visual.net/notepadPlus.vcxproj to enable Windows path normalization APIs. See the GitHub Security Advisory GHSA-rqfm-pw34-r7j6 for the full advisory.

Workarounds

Disable snapshot mode via Settings → Preferences → Backup until the upgrade is deployed to prevent automatic session restoration.
Delete or reset session.xml before launching Notepad++ if tampering is suspected.
Apply least-privilege controls so untrusted processes cannot write to %AppData%\Notepad++\.

bash

# PowerShell: audit session.xml files for traversal sequences
Get-ChildItem -Path "$env:APPDATA\Notepad++\session.xml" -ErrorAction SilentlyContinue |
  Select-String -Pattern 'backupFilePath="[^"]*\.\.[\\/]'