WinGup ZIP Path Traversal in Notepad++

Executive Summary

CVE-2026-57233 is a path traversal vulnerability in Notepad++'s WinGup plugin extraction function. It allows attackers to craft malicious ZIP files with path traversal sequences in filenames, such as ../mimeTools/mimeTools.dll. When extracted, these sequences overwrite DLLs in sibling plugin directories. If Notepad++ loads the overwritten DLL, attacker-controlled code executes within the Notepad++ process.

Useful 0 Not Useful 0

Detection Guidance

Check Notepad++ version with 'notepad++ --version' or via Help > About. If version is below 8.9.7, the system is vulnerable. Inspect plugin directories for unexpected DLL modifications or new files with suspicious names like ../mimeTools/mimeTools.dll.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system with the privileges of the Notepad++ process. If Notepad++ runs as administrator, the attacker gains elevated privileges. Successful exploitation requires user interaction, such as opening a malicious plugin package.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR or HIPAA if it leads to unauthorized access or modification of sensitive data. Since the flaw allows arbitrary code execution within the Notepad++ process, an attacker could gain control over the application and access or alter files containing personal or health data, depending on the system's configuration and the data processed by Notepad++.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Notepad++ to version 8.9.7 or later. Avoid opening untrusted plugin packages or ZIP files. Review plugin directories for unauthorized file changes. If compromised, remove malicious DLLs and restore from clean backups.

Useful 0 Not Useful 0