CVE-2026-52884

Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\..\ after a trusted directory prefix passes the check while resolving to an untrusted location. The CVE-2026-48800 patch adds isInTrustedDirectory() validation in Command::run() (RunDlg.cpp) before calling ShellExecute(). This function checks whether the resolved executable path is under a trusted directory. This vulnerability is fixed in 8.9.6.2.

• CWE-42

• https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4Patch
• https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-p58x-r3c9-x9p6Exploit, Patch, Vendor Advisory

Published

Jun 26, 2026

Last Modified

Jun 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5287Use after free in PDF in Google Chrome prior to 146.0.7680.1…8.8
• CVE-2026-52870The MCP Python SDK, called mcp on PyPI, is a Python implemen…7.6
• CVE-2026-52878Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-52879Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-5288Use after free in WebView in Google Chrome on Android prior …9.6
• CVE-2026-52880Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-52885Notepad++ is a free and open-source source code editor. Prio…6.3
• CVE-2026-52887NocoBase is an AI-powered no-code/low-code platform for buil…10
• CVE-2026-52888NocoBase is an AI-powered no-code/low-code platform for buil…6.8
• CVE-2026-5289Use after free in Navigation in Google Chrome prior to 146.0…9.6
• CVE-2026-52890Wekan is open source kanban built with Meteor. Prior to 9.31…7.1
• CVE-2026-52891Wekan is open source kanban built with Meteor. Prior to 9.07…9.9