{"id":"CVE-2026-52884","summary":"Notepad++: CVE-2026-48800 Bypass","details":"Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\\..\\ after a trusted directory prefix passes the check while resolving to an untrusted location. The CVE-2026-48800 patch adds isInTrustedDirectory() validation in Command::run() (RunDlg.cpp) before calling ShellExecute(). This function checks whether the resolved executable path is under a trusted directory.  This vulnerability is fixed in 8.9.6.2.","aliases":["GHSA-p58x-r3c9-x9p6"],"modified":"2026-07-15T22:25:35.314527Z","published":"2026-06-26T20:11:40.227Z","database_specific":{"cwe_ids":["CWE-42"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52884.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52884.json"},{"type":"ADVISORY","url":"https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-p58x-r3c9-x9p6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52884"},{"type":"FIX","url":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/notepad-plus-plus/notepad-plus-plus","events":[{"introduced":"41dd976310db0ba551bb8a2810b60331df3a77f5"},{"fixed":"ea1508855e9c4528f6198ce9d345f13cb759ebf4"}],"database_specific":{"cpe":"cpe:2.3:a:notepad-plus-plus:notepad\\+\\+:8.9.6.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.9.6.1"},{"last_affected":"8.9.6.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["8.9.6.1","= 8.9.6.1","v8.9.6.1"],"database_specific":{"vanir_signatures":[{"target":{"file":"PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp","function":"stripQuotes"},"deprecated":false,"digest":{"function_hash":"57715021251719253009272763331133225787","length":198},"id":"CVE-2026-52884-00f46ffa","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4"},{"digest":{"length":90397,"function_hash":"234957821588392461698023046225313384601"},"id":"CVE-2026-52884-0a3c972d","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/NppBigSwitch.cpp","function":"Notepad_plus::process"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"function":"isAbsolutePath","file":"PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp"},"deprecated":false,"digest":{"function_hash":"34797786676988534479024319250253613667","length":84},"id":"CVE-2026-52884-0fecb6c4"},{"digest":{"function_hash":"141650213066311194269524976446952869020","length":4478},"id":"CVE-2026-52884-144906a0","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/NppIO.cpp","function":"Notepad_plus::doSave"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"282003234591345257812698996841375926271","length":557},"id":"CVE-2026-52884-2d493c44","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"function":"isRiskyExecutableByExt","file":"PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp"}},{"signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp","function":"isInTrustedDirectory"},"deprecated":false,"digest":{"function_hash":"239555576754383490789194986872875976900","length":404},"id":"CVE-2026-52884-492a7047","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp","function":"Command::run"},"deprecated":false,"digest":{"function_hash":"304192662690852942024534102238910733909","length":3872},"id":"CVE-2026-52884-58767ce6"},{"signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"function":"NppParameters::createXmlTreeFromGUIParams","file":"PowerEditor/src/Parameters.cpp"},"deprecated":false,"digest":{"function_hash":"53143733507561401743447247284844835075","length":23117},"id":"CVE-2026-52884-66263e8a","signature_type":"Function"},{"deprecated":false,"digest":{"length":107994,"function_hash":"94839412049221064790919787837007080731"},"id":"CVE-2026-52884-76162ddf","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/NppCommands.cpp","function":"Notepad_plus::command"}},{"signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp"},"deprecated":false,"digest":{"line_hashes":["291856488115243240719239329277530979120","296419932292752532850775469238426339491","239319915313456933337369592604979997486","45500142151870946048966187231536242380","296454638851886689611147435557583172391","90650900868760321478726229179435700472","197252074757657007336680637732907628471","278322212825350195567846524060518428642","246723423835075915178956670555465465233","14818275175044384320606367079895712985","287257883716674076159954018231854317974","262557443996826122701914308497929256659","196397951820026750688256546720890619942","33762167428290932276842014213398158197","107553005559896514675625381188575977489","117689821346061447333821891991767549223","192673171575410521034035190330171032016","200646961885356338697618866651333102739","44892939277725163278511270253868375396","317197724515749890399605842253759460657","312470116357116458788479815162407203214","37157910830856497099130779358631941798","284041850032351940630573714466213366804","108311903376553039620247456694139046360","201886814830084505218515073888528436477","163121092154658797051343027992596061981","25051191987248391040969727575587704942","57849961878921539244839884307815567418","1335782086916865997960956688288752365","67765193304136485436902712491801047440","299119097402486905554942935929656510841","276973827680426758405639520530116052027","242655396067348056700067076958331928451","98480949819782870161788550365111993232","100581522888936959701787900332104406963","79147907088189339850145248320456570320","22357612337931294495769636696828289650","32436995564194794293278862019351600177","248365913921581909969252280883801018083","212527736197941719961652982085554407959","107274642815905472413797761565334754806","254920905336500687678066602789426637829","196530286257440418385141123543632149776","294514190379683642087961940027103849784","102773042227712380051185624212894701760","193945555105656936453847297800470789796","36394795474628066435485696957456727451","152783894038478485668849458655007745195","142367965660013809510404211763611244670","202112125324090108557605074850115221768","221758013789742212941741191430489008294","252857162420537765339179761278001570028","32118120085932686825403855994854729784","188958953704680198847315445833721626904","294736800828531951324065830353563894626","113185020247763548265878612919452936750","266280837833930284901517385017751033367","152118755090962435109049859708280160172","140257798641680969948957939050097628221","58849311254902015527281066323551548158","211925557383236136966866597959690944888","244447499537561633976414813377641025469","331318856142014081750964891457206260161","119258988697698457769296765622298402469","132866347294831087580986665693601442038","351726396663710204217095968850019335","239164442052515289485859478136601898012","212386273288013625600945661064363531929","334954744000723401126115826557116819776","60785722366191656924668622384111212077","205552714175108980532891748384559680156","77502868015929452289002087273515482301","249993373260411852810715234226764827550","214119117802667157176084578550404361038","124832251407169317370811554373185467649","280939216169899352342722258524723892715","35351722412039830679476363717211604474","90264211851303427413648027724741640874","275887274426653518134575467167382952028","56352142133440881888149953442404994417","79929896174919516706123434099940561774","29938192366198591599301633771794687683","289977522975447029010790706828189262138","304051141944162891980425968441991527278","320967240137442544193876621913528436407","316400600651096741504256723738617848728","266681785912755434595065447318040932589","47192034466640865887042159446639032599","238690317135379883858851525471403972128","107714819386652834427736091273175900961","138564663887335090953661175669028279286","173499367561009346728900605022864457872","134845993169748252107305886083099231038","128525066039468663770851795509488046553","120714538373420116700246306236343589212","145275701810118159160757718738770557871","181159894689154045510802749745066048642","82782763763556819191308412427167786773","122385532859081884677420730605763864103","333074141710635353878506192750459148821","249412886411845597893769675688741452048","78359717826414540234257357776492384870","325566529092806297766701454658590319932","288812201888424320372775456126483523212","73860336072342879466493517852370335030","194548194793721987416471498440238729912","165454279223502431391889970646832498447","9908158757272192214098703770521166466","242048200552190015032642103680627595873","143064403354880240675226185785363244765","75402714884274942841221294260055851675","137863709056759561376318716038755658122","289396987365979308507480683218818017509","142826848257394643480127915892801492667","295283912055527817536541175023838238686","101875832165653810504482981875244412986","87989689119265312543245440920893960847","237798365828535112700245000260691912650","45220669590552131521081071463940506501","229414934152104561876780988731353972304","40159501649319686529247579540993305040","205241278823867256680896265097579498889","152720025119527036115578920000094748183","141255716798423441195398575172604542811","254425981104260691038006684244061116666","216579781005391562050458783481129437649","142826848257394643480127915892801492667","295283912055527817536541175023838238686","101875832165653810504482981875244412986","197203507105221881592891883635360506048","236167049996455294017322266581014626790","92618939485429865738902875772898124015","275857269975284178066778648942493327281","71334018006259736593380915164545292165","333711199904030339205507002245879676787","199712620363285528403742916484315449139","123400483388642610359160553045169736799","105332340235492354810081142206919927509","291301730800146961982152898671176093515","142826848257394643480127915892801492667","295283912055527817536541175023838238686","101875832165653810504482981875244412986","295955283008331055204993773505117272694","201097310623176065242828448154168766841","335123505707730826615979107919082899452","148047228652569558105646874518827226302","203967612952551430440778750487640170077","20621002969495046109445511986566610063","101269335686082840263359718853366271583","202927020100144233684173021090256298048","155776944011838029329806124238928406465","179811293732189000679473685515085432856","189074684458411782240737688865680700314","126499457004388520238561809063089162152","128525066039468663770851795509488046553","120714538373420116700246306236343589212","145275701810118159160757718738770557871","181159894689154045510802749745066048642","82782763763556819191308412427167786773","87732556451251395288031910622329647746","108587633537507210242609878158511307392","108587633537507210242609878158511307392","43982800487453743223376776330095497251","273457448422440938919506193819847484971","84207832055785734854047618151627972610","144569322730669414209081522839531881904"],"threshold":0.9},"id":"CVE-2026-52884-79a7fc47","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"109494845354731416022535833147608909886","length":2320},"id":"CVE-2026-52884-8dbb1abc","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/Parameters.cpp","function":"NppParameters::writeShortcuts"}},{"digest":{"line_hashes":["23355134966573147800151049580576040407","45045178626612623635285321704757135171","156099773929590567428758797921642209778","28017988256905560370768701819693796222","254000459067224967050816449379817493198","153235003288157741688850803898177821023","93297282313766684730336886893050494410","236156955323429400545728075426061304989","43742421085869526508015024587318752108","219823797813907370058145401292262446390"],"threshold":0.9},"id":"CVE-2026-52884-8f1ffa67","signature_type":"Line","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/NppBigSwitch.cpp"},"deprecated":false},{"target":{"file":"PowerEditor/src/Parameters.cpp","function":"NppParameters::load"},"deprecated":false,"digest":{"function_hash":"34536463110491822296074858134099931217","length":11149},"id":"CVE-2026-52884-9358a70f","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4"},{"deprecated":false,"digest":{"function_hash":"232139962156494229005658411752921605725","length":34203},"id":"CVE-2026-52884-af54e27d","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/Parameters.cpp","function":"NppParameters::feedGUIParameters"}},{"digest":{"function_hash":"186318164616153497347919100682625794877","length":333},"id":"CVE-2026-52884-b3690d97","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp","function":"resolveExecutablePath"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/Parameters.h"},"deprecated":false,"digest":{"line_hashes":["212441088122256644971954088944501062115","118809618971646596014347490819021071905","210782600028155869867232302044257511176","298263174537701833723743102158519297358","289427337653184032013609214782056908479","142845926653542928834591553414620619635","210995430294167593867654003269680266253","95894627199867020846272200825787094323","54479628395159415484332240298325212192","258954822969268795852529354408270236963","90272349413917397997321221115603176666","307344668360685656138476394123180387358","210251203802133942391350644503902634446","99025834399147289940791027952367402765","108313657876389990806031030831163701354","251627591490786479439211214952225614229","211047607919429321692404857768748114292","177892827101796957410765060642377849013","175180910591256764100617826922546388701","64014551192298145094824109327973678297","113738596305508766617170709768968520883","252011085004368197042389100202021009726","147949405992973632780813680175864391729","137801779606324327620907945248386274366","200956581067887397806729718512672264025","100566177859850005791505144888125643009","281215196257529179598419712079531362932","169386416701746586250327105354052105535","106364503420598370384029650106194384176","282260278266614645282942054013448374593","128515348861795443709861533787946591494","189656775235735870713402846662644242682","45143255336723402128901078441933288024","108859169796303380513060315656087567256","22928067744474188137847706736604527376","19150382206634922888449060680775553138","26885953538271046020823987783026575890","8978063209411257358580779164960257171","318371511818213889552295193432629293979","52489523615087098475166229371295936531","228099630824521778405825141465286172573","272589027783276484322502427684575753534","133136287495928694539507332759453655300","132001499106337244630985808646032206317","248679742697362453968980171077603955878","275259585170871306927308321597590811676","286071686844895148606421980499235298621","281878435930452033205745514352355885369","1928079997803832293555593948242703275","236008209067874847275066676024226511678","115388097186453986025401407019192604356","270370785991907266813124852568666454556","10643706047243672543517778417066675436","98928485608607366116589515363322079158","139309908453694908962399055872861264932","98451280145712132851061407595247154841","239714739383089800046426342060772490237","324366286238933557951439239093315784742","235310402154816323243953324044325509283","175269350057939641100185481218935158254","91649373635948030769183321555518138934","251225940218621412233667233740695138952","282189490918580292063851878142689737386","66954480340055444071364457528329988853","169198552274134721157328223716439577366","79514599794157249340745770831026130126","75114995142603893922209705412528341003","105355096245947269669428900428798902636","54679541016134014928215069124267590238","23702260881432033686513534662113883340","203411076074561584788682964975465005079","43800736412510805019904922553674199819","283357354479246858835890541262079486177","263516129557506787615221144212580201651","84539823147757048392681113684657577409","337315160209222789239311139096915282453","173051230082951688873947643589677111361","248798931238641296317387300206338122207","152114863852224046232334421196712706649","164759627290123558765383753962946630462","46549926181058843897576716360532839374","267973006450100262316368080416919642393","89240237913584344628349241056949527026","149895311336272176474568561758840801955","136042460349490965473789405618362371813","84897390034516145941285503628434786733","167867203181473404510028910796558173083","38933621415358835055789383755235497160","281849686983580227248680125925011221016","288427050071332973524358400415601031987","330792616354798860131282304044623400629","238300190922447382684945138196897222444","249341527495681914625314074681003227689","118901607489863942908564035215542092564","321561014417158809909297456679425825352","222576418650538627298800266267539124349","108876818030049584753539207033534458892","196831763911533672301996685440964023079","137380351236716635704668504204987945298","68426826993802266347664472962115436859","198964580914937238597550170737146386942","61677244877232515887350635888747164579","102426615933467361662370433629824098939","192325460016224096720101398074833636296","156235324059401442747191442638568482782","81893398798311020864335829648306876312","79476717129125878872364399770356010169","16254779201687710800746243571375570448","127104101825661727143676357232088234772","165107883519118220867018400686710231506","114431025387022685223448965440874777845","309937460632408594206880562042455593731","293162373900971988035403544432183551977","156805032344360133049379444774759937908"],"threshold":0.9},"id":"CVE-2026-52884-b8093f99","signature_type":"Line"},{"target":{"file":"PowerEditor/src/NppIO.cpp"},"deprecated":false,"digest":{"line_hashes":["272231922236420682011334388285814370036","75746009551352765203351937262433310288","271354559087750496311962906960186727142","155777289741371298400077382587270640895"],"threshold":0.9},"id":"CVE-2026-52884-d4c699c8","signature_type":"Line","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4"},{"target":{"file":"PowerEditor/src/NppCommands.cpp"},"deprecated":false,"digest":{"line_hashes":["77866809265109152300468891826059120784","177491014184586287590094878661077325516","209484206118844332949487766767307871693","165484693603274800000292941919946656116","274126827140502065226817239869762718012","195825040592356939283647313877513940722","126813043044185702719199196823472305833","32696051964743732661532932094278168981","247408964376591830044101983082199203844","68758691204257197938374015992748731075","219970514269380934897126854998895234951"],"threshold":0.9},"id":"CVE-2026-52884-d8635472","signature_type":"Line","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4"},{"id":"CVE-2026-52884-dc4d522f","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"function":"isSafeURL","file":"PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp"},"deprecated":false,"digest":{"function_hash":"132402401137549418036618123604617481868","length":91}},{"deprecated":false,"digest":{"function_hash":"9725586782540113152839572909920535930","length":137},"id":"CVE-2026-52884-f522ed4a","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp","function":"isURL"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4","target":{"file":"PowerEditor/src/Parameters.cpp"},"deprecated":false,"digest":{"line_hashes":["156923956403344832910680652343610878854","316943371142748149680862609407757174474","67618231266211292895326597976358362576","243028197664895824391158371528810307322","290127930966360045438317680929542317309","303495010605903957894185991587213516656","61215874624963878287077555454955278888","2315430540852987720608064628401603379","282045889655696222119150385359434260539","173356224949959543636903705638401281343","308423854716346854769473772213695042617","103956517114017417872813365707656294667","339115997811615216426726803705931532141","135005271943632924821557929079847711456","333400962029871898521679230344445444558","51316309715218506752180965605253906024","187002811728001527312993269455542902335","7867810233777234201961066138457483452","17479381195224044203308745793657322337"],"threshold":0.9},"id":"CVE-2026-52884-f5af022e"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52884.json","vanir_signatures_modified":"2026-07-15T22:25:35Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}