CVE-2026-52886
Received Received - Intake

Path Traversal in Notepad++ via session.xml Backup Restoration

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts_with against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode restoration to read an arbitrary user-readable file outside the backup directory into an editor tab. This issue is fixed in version 8.9.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-52886
EUVD
EUVD-2026-60374

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
notepad++ notepad++ to 8.9.6.4 (exc)
notepad++ notepad++ 8.9.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52886 is a path traversal vulnerability in Notepad++ versions prior to 8.9.7. It occurs during session file restoration in snapshot mode. The software validates the backupFilePath attribute in session.xml using a raw string prefix check without normalizing paths. This allows attackers to include directory traversal sequences like ..\ after a valid backup directory prefix to bypass validation. For example, a path like C:\backup\..\..\Windows\System32\drivers\etc\hosts would pass the check but resolve to an arbitrary file outside the intended directory.

Detection Guidance

Check Notepad++ version with: notepad++ -v. If version is below 8.9.7, the system is vulnerable. Inspect session.xml for backupFilePath attributes containing parent-directory sequences like ..\. Use file system monitoring tools to detect unauthorized file reads by Notepad++.

Impact Analysis

This vulnerability allows an attacker with write access to session.xml to inject a traversal path. When Notepad++ loads the session file in snapshot mode, it will display the content of sensitive files like SSH keys, .env files, or browser credential stores in an editor tab. The attacker can read these files but cannot modify them. The impact is limited to information disclosure, with a medium severity rating due to its read-only nature.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Exposure of personal data, credentials, or system files could result in data breaches, triggering mandatory breach notifications and potential fines. Organizations using vulnerable versions of Notepad++ should update to version 8.9.7 or later to mitigate this risk.

Mitigation Strategies

Upgrade Notepad++ to version 8.9.7 or later immediately. Remove write access to session.xml for untrusted users in portable installations. Disable snapshot mode if not required. Monitor for suspicious file access patterns in system logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52886. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart