CVE-2026-57233
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.
Risk Assessment
The vulnerability allows remote code execution in the context of the Notepad++ user, which could lead to system compromise. However, the attack requires opening a malicious ZIP file.
Recommendation
It is recommended to upgrade Notepad++ to version 8.9.7 or later. Also, avoid opening untrusted ZIP files.
Original NVD description (English source)
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.