CVE-2026-52886: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-52886 is a path traversal vulnerability in Notepad++ that allows a local attacker with write access to session.xml to read arbitrary user-readable files outside the intended backup directory. The flaw affects all Notepad++ versions prior to 8.9.7 and was disclosed on July 14, 2026, with a fix released in version 8.9.7. It carries a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Feedly).

The root cause is an improper path validation (CWE-22: Path Traversal) in Notepad++'s session restoration logic. When loading session.xml in snapshot mode, the application validates the backupFilePath attribute using std::wstring::starts_with() against the expected backup directory path — a raw string prefix comparison that performs no path normalization. An attacker can craft a backupFilePath value such as C:\...\backup\..\..\..\..\Users\victim\.ssh\id_rsa that passes the prefix check but, when resolved by the OS, points to an arbitrary file outside the backup directory. The fix (commit 7e66f36) introduces PathCchCanonicalize() to normalize the path before the prefix comparison, eliminating the traversal bypass (GitHub Advisory, Fix Commit).

Successful exploitation results in unauthorized disclosure of any user-readable file on the system, with the file contents loaded directly into a Notepad++ editor tab. High-value targets include SSH private keys, .env files, browser credential stores, and Windows system files such as hosts. There is no integrity or availability impact — the vulnerability is read-only exfiltration — but the confidentiality impact is rated High given the breadth of accessible files (GitHub Advisory, Feedly).

A public proof-of-concept (PoC) exploit is available on GitHub, including a PowerShell script (poc_path_traversal.ps1) with concrete step-by-step instructions and a crafted payload (PoC GitHub). The EPSS score is approximately 0.18%, reflecting low but non-zero probability of exploitation in the wild. Exploitation requires local access and write permissions to session.xml (typical in portable Notepad++ installations), and there is no confirmed evidence of in-the-wild exploitation or threat actor attribution at this time (Feedly). The vulnerability is not listed in the CISA KEV catalog.

1. Identify target installation: Confirm the victim is running Notepad++ prior to version 8.9.7 with snapshot/session restore mode enabled (isSnapshotMode=yes in configuration).
2. Locate session.xml: Find the session.xml file in the Notepad++ user data directory (for portable installs, this is the local application directory; for standard installs, it is in %APPDATA%\Notepad++\).
3. Determine backup directory path: Identify the backup directory path used by the installation (e.g., C:\path\to\npp\backup\).
4. Craft malicious backupFilePath: Construct a traversal payload that starts with the backup directory string to pass the starts_with() check but includes ..\ sequences to escape it, e.g.:

   C:\path\to\npp\backup\..\..\..\..\Users\victim\.ssh\id_rsa

5. Inject into session.xml: Overwrite or modify the backupFilePath attribute of a File element in session.xml with the crafted traversal path.
6. Trigger restoration: Wait for or cause Notepad++ to launch or reload the session (e.g., restart the application). The OS resolves the ..\ sequences, bypassing the prefix check, and loads the target file's contents into an editor tab.
7. Exfiltrate data: Read the sensitive file contents (e.g., SSH private key, credentials) directly from the editor tab (GitHub Advisory, PoC GitHub).

• File System: Unexpected modification timestamp on session.xml in the Notepad++ data directory; backupFilePath attributes in session.xml containing ..\ sequences or pointing outside the backup\ subdirectory.
• File System: Presence of poc_path_traversal.ps1 or similar PowerShell scripts in user-accessible directories.
• Logs: Windows file access audit logs showing Notepad++ (notepad++.exe) opening files outside its backup directory (e.g., %USERPROFILE%\.ssh\id_rsa, %APPDATA%\ credential stores, C:\Windows\System32\drivers\etc\hosts).
• Process: Notepad++ process (notepad++.exe) with open file handles to sensitive files not typically associated with text editing sessions.

Upgrade Notepad++ to version 8.9.7 or later, which introduces PathCchCanonicalize() to normalize backupFilePath values before the directory prefix check, preventing traversal bypasses (Notepad++ Release, Fix Commit). As a workaround for users who cannot immediately upgrade, restrict file system permissions on session.xml to prevent write access by other local users or processes. Disabling snapshot/session restore mode also eliminates the attack surface for this specific vulnerability (GitHub Advisory).

The vulnerability received moderate coverage from cybersecurity news outlets, with articles from CyberSecurityNews, CyberPress, VPNCentral, and The Cyber Express covering the Notepad++ 8.9.7 security update that addressed this and other flaws (CyberSecurityNews, VPNCentral). SecureReading noted the potential enterprise risk, highlighting that Notepad++ is widely deployed on enterprise workstations (SecureReading). The Hacker News included the vulnerability in its weekly recap, and Tenable published a detection plugin (Nessus plugin 327203) shortly after disclosure (Tenable).