CVE-2026-57233: Notepad++ Path Traversal Vulnerability

CVE-2026-57233 Overview

CVE-2026-57233 is a path traversal vulnerability [CWE-22] in the WinGup updater component of Notepad++, a widely used open-source source code editor for Windows. The decompress function joins untrusted ZIP entry names to the unzipDestTo destination path without validating that the resulting path remains inside the intended directory. A malicious archive containing entries such as ../mimeTools/mimeTools.dll can overwrite a Dynamic Link Library (DLL) in a sibling plugin directory. Notepad++ then loads the attacker-controlled DLL the next time the affected plugin is invoked, resulting in code execution in the context of the user. Versions prior to 8.9.7 are affected.

Critical Impact
A crafted update archive can overwrite plugin DLLs outside the intended extraction directory, leading to arbitrary code execution when Notepad++ next loads the affected plugin.

Affected Products

Notepad++ versions prior to 8.9.7
WinGup updater component bundled with Notepad++
Notepad++ plugin ecosystem consuming the WinGup update flow

Discovery Timeline

2026-08-17 - CVE-2026-57233 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-57233

Vulnerability Analysis

The flaw resides in WinGup, the update helper shipped with Notepad++. During update extraction, decompress iterates over ZIP entries and constructs the output path by calling PathAppend(extraitFullFilePath, file2extrait), where file2extrait originates from the archive's central directory. Because the entry name is not canonicalized nor bounded to unzipDestTo, traversal sequences such as ..\ walk out of the extraction root.

Notepad++ loads plugins from predictable sibling directories. An entry targeting ../mimeTools/mimeTools.dll overwrites the legitimate mimeTools.dll on disk. The next invocation of that plugin loads the attacker's DLL in-process, granting arbitrary code execution with the privileges of the Notepad++ user.

Root Cause

The root cause is missing canonical containment validation on decompressed file paths, a class of bug commonly referred to as Zip Slip. The updater trusted archive metadata and relied on PathAppend semantics, which do not resolve .. segments or enforce that the final path stays under the extraction root.

Attack Vector

Exploitation requires the victim to trigger an update using a malicious or tampered archive delivered through the WinGup update flow. The vector is network-based with user interaction, and successful exploitation compromises integrity and availability of the host application through DLL replacement.

cpp

// Patch from src/winmain.cpp (WinGup) — canonical containment check
	wstring extraitFullFilePath = unzipDestTo;
	PathAppend(extraitFullFilePath, file2extrait);

	// Zip slip fix: canonicalize and verify path stays within unzipDestTo
	wchar_t canonicalDest[MAX_PATH];
	wchar_t canonicalRoot[MAX_PATH];
	if (!GetFullPathNameW(extraitFullFilePath.c_str(), MAX_PATH, canonicalDest, nullptr) ||
	    !GetFullPathNameW(unzipDestTo.c_str(), MAX_PATH, canonicalRoot, nullptr))
		return false;

	// Ensure canonicalDest starts with canonicalRoot + backslash
	wstring destStr(canonicalDest);
	wstring rootStr(canonicalRoot);
	if (rootStr.back() != L'\\') rootStr += L'\\';
	if (destStr.substr(0, rootStr.size()) != rootStr)
	{
		// Path traversal attempt - skip this entry
		continue;
	}

Source: Wingup Commit 7670296a

Detection Methods for CVE-2026-57233

Indicators of Compromise

Unexpected modification timestamps on plugin DLLs under the Notepad++ plugins\ directory, particularly mimeTools.dll and other bundled plugin binaries.
Presence of ZIP archives containing entry names with ..\ or ../ sequences processed by gup.exe.
Child processes or DLL loads originating from notepad++.exe that resolve to unsigned or recently rewritten plugin modules.

Detection Strategies

Monitor file writes to plugins\*\*.dll initiated by gup.exe and correlate them with the extraction root to flag out-of-scope writes.
Inspect update archives handled by WinGup for ZIP entries whose normalized paths escape the intended destination.
Alert on DLL load events where the module hash for a known plugin (for example mimeTools.dll) diverges from the vendor-shipped baseline.

Monitoring Recommendations

Baseline plugin DLL hashes after installation and compare on process start to detect silent replacement.
Log and review all gup.exe executions, including source archive path and destination directory, from managed endpoints.
Track EDR telemetry for notepad++.exe loading DLLs from paths outside expected plugin subdirectories.

How to Mitigate CVE-2026-57233

Immediate Actions Required

Upgrade all Notepad++ installations to version 8.9.7 or later, which includes the patched WinGup decompress routine.
Audit existing plugin directories for unexpected or unsigned DLLs and restore known-good binaries where tampering is suspected.
Restrict end-user ability to run updates from untrusted network sources until endpoints are patched.

Patch Information

The fix is delivered in Notepad++ 8.9.7 via WinGup pull request #106 and commit 7670296a. The patched code canonicalizes both the destination path and the extraction root using GetFullPathNameW, then rejects any ZIP entry whose resolved path does not begin with the canonical root followed by a backslash. See the GitHub Security Advisory GHSA-hjxw-84rf-wg5r and the Notepad++ Release v8.9.7 notes for full details.

Workarounds

Disable the in-application update flow until upgrading to 8.9.7 by removing or renaming gup.exe in the Notepad++ installation directory.
Apply application allowlisting to prevent notepad++.exe from loading unsigned or modified DLLs from plugins\ subdirectories.
Restrict write permissions on the Notepad++ installation and plugins\ folders so that standard users cannot overwrite plugin binaries.

bash

# Verify installed Notepad++ version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Notepad++*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation

# Baseline plugin DLL hashes for tamper detection
Get-ChildItem "C:\Program Files\Notepad++\plugins" -Recurse -Filter *.dll |
  Get-FileHash -Algorithm SHA256 |
  Export-Csv -NoTypeInformation notepadpp_plugin_baseline.csv