Medium severity · published Aug 17, 2026
CVE-2026-52886
Notepad++: session.xml backupFilePath starts_with Bypass
5.1
CVSS
0.2%
EPSS
No
On KEV
Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts_with against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode restoration to read an arbitrary user-readable file outside the backup directory into an editor tab. This issue is fixed in version 8.9.7.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
notepad-plus-plus · notepad-plus-plus
< 8.9.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-52886
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-52886
github.com
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/7e66f36db666a13b09fb5c31232ab2ca1c2ebccc
github.com
https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.7
github.com
https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-rqfm-pw34-r7j6
More from notepad-plus-plus
7.5
CVE-2025-15556
Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
8.6
CVE-2026-85279
Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value
8.1
CVE-2026-57233
Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
7.8
CVE-2026-77605
Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
7.8
CVE-2026-86054
Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path