CVE-2026-52884: Notepad++ Path Traversal in Run Dialog – Arbitrary Code Execution Vulnerability

Technical summary

The vulnerability stems from improper path canonicalization in the isInTrustedDirectory() validation function added to Command::run() in RunDlg.cpp. The function performs a prefix-based path check using PathIsPrefix() or equivalent logic, comparing the target path string against known trusted directory strings without first resolving the full canonical path. This allows an attacker to craft paths containing directory traversal sequences (..\..) that satisfy the prefix check while the operating system resolves them to untrusted locations. The ShellExecute() call then executes the de-referenced malicious executable. This is a classic path normalization bypass where validation happens before resolution. The fix in 8.9.6.2 ensures canonical path resolution before the security check is applied.

Business impact

The vulnerability poses a moderate-to-high risk to organizations where users work with untrusted files or scripts. An attacker could deliver a specially crafted file (document, script, or project file) that, when opened in Notepad++, tricks a user into executing an external command through the Run dialog that actually launches malware. This could lead to local privilege escalation, lateral movement, data theft, or system compromise. The attack requires user interaction—specifically, the user must actively invoke the Run command—which limits the attack surface but does not eliminate it in environments where users regularly execute external tools or build scripts through Notepad++.

Affected systems

Notepad++ versions 8.9.6.1 and earlier are affected. Users of version 8.9.6.2 and later have the fix. The vulnerability applies to Windows systems, as the attack relies on Windows path handling semantics and the ShellExecute() API. Other platforms using Notepad++ may or may not be affected depending on their path resolution behavior; verify with the vendor for non-Windows deployments.

Exploitability

The vulnerability is exploitable but requires user interaction. An attacker must deliver a file or convince a user to open a file in Notepad++ and then manually invoke the Run dialog with a maliciously crafted command. The path traversal technique is well-known and straightforward to construct, so the primary barrier is social engineering or file delivery. Automated exploitation is not feasible without user action. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been widely reported, though this does not rule out targeted or proof-of-concept activity.

Remediation

Upgrade Notepad++ to version 8.9.6.2 or later immediately. The upgrade can be performed through Notepad++'s built-in auto-update feature (Help > Update Notepad++) or by downloading the latest installer from the official Notepad++ website. For organizations with controlled deployment, test version 8.9.6.2 in a lab environment before rolling out to ensure compatibility with existing scripts or plugins. No workaround is available for unpatched versions; patching is the only remediation.

Patch guidance

Update Notepad++ to 8.9.6.2 or any subsequent release. The patch introduces proper path canonicalization in the isInTrustedDirectory() function before the ShellExecute() call, eliminating the prefix-matching bypass. Organizations can automate updates via managed deployment tools or enforce minimum version requirements in security policies. Consider testing the patched version with any custom Run configurations or external tools users rely on to ensure no breakage.

Detection guidance

Monitor for Notepad++ installations on user machines and verify the version is 8.9.6.2 or later using software inventory tools or endpoint detection and response (EDR) agents. In environments where users regularly use the Run dialog feature, watch for suspicious child processes spawned by notepad++.exe with command lines containing path traversal sequences (..\..) or references to unusual executable locations. Alert on Run dialog invocations with paths pointing outside standard system directories. Log execution of any external commands triggered via Notepad++.

Why prioritize this

This vulnerability merits prompt patching due to its HIGH CVSS score (7.8), local attack vector, and the potential for arbitrary code execution with user-level privileges. While it requires user interaction, Notepad++ is widely used by developers and system administrators who frequently execute external tools. Organizations should prioritize patching based on the prevalence of Notepad++ usage in their environment. The lack of KEV listing suggests it has not reached critical mass in active exploitation, providing a window to patch before widespread campaigns emerge.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L) limiting remote exploitation; low attack complexity (AC:L) as the path traversal technique is straightforward; no privilege requirement (PR:N) to trigger the vulnerability; required user interaction (UI:R) such as opening a file and invoking Run; confidentiality, integrity, and availability impacts (C:H/I:H/A:H) as successful exploitation leads to arbitrary code execution. The high impact ratings acknowledge the severity of arbitrary code execution, while the user interaction requirement prevents a critical score.

Frequently asked questions