Description

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-17T20:16:44.453Z",
  "pubdate": "2026-08-17T20:16:44.453Z",
  "executiveSummary": "A path traversal vulnerability exists in the WinGup decompress function of Notepad++ prior to version 8.9.7, which allows an attacker to achieve arbitrary code execution.\nThe vulnerability arises due to the lack of canonical containment validation when joining untrusted ZIP entry names to the destination directory path during the extraction process.\nBy supplying a specially crafted archive containing relative path traversal sequences, such as ../mimeTools/mimeTools.dll, an attacker can overwrite critical dynamic link libraries located within sibling plugin directories.\nWhen Notepad++ subsequently initializes and loads the targeted plugin, the malicious payload is executed within the context of the running application.\nThis flaw impacts all versions of Notepad++ utilizing vulnerable WinGup implementations prior to 8.9.7.\nSuccessful exploitation enables local code execution, potentially leading to privilege escalation or complete compromise of the user session depending on the execution context of the affected application.",
  "technicalDetails": "The vulnerability resides within the WinGup decompress function utilized by Notepad++ for handling update packages prior to version 8.9.7.\nThe root cause of the flaw is the improper handling and lack of strict canonical containment validation on untrusted ZIP entry names before concatenating them with the extraction destination variable unzipDestTo.\nBecause path traversal characters such as ../ are not filtered, neutralized, or validated against the intended destination root, an archive entry can traverse outside of the designated temporary extraction boundary.\nDuring the exploitation phase, an attacker provides a maliciously crafted update package containing archive entries with relative traversal paths, specifically targeting sibling directories such as ../mimeTools/mimeTools.dll.\nThe vulnerable extraction routine blindly trusts the filename string provided within the archive headers and writes the payload file directly into the specified traversal path, thereby overwriting an existing legitimate DLL inside a sibling plugin directory.\nSubsequent execution occurs when Notepad++ performs its standard plugin loading routine upon startup or reload events.\nBecause the application loads the overwritten DLL from the plugin directory, the arbitrary attacker-controlled code contained within the malicious DLL is executed with the privileges of the Notepad++ process.\nThe vulnerability requires the target to process a malicious update or extraction operation, typically triggered via update mechanisms or local manipulation.\nNo authentication or special network exposure is inherently required if the update mechanism processes an untrusted archive, resulting in local code execution impact."
}