Is CVE-2026-52886 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52886 being exploited in the wild.

How severe is CVE-2026-52886?

Informational severity, published 17 August 2026.

Which products and versions are affected?

Notepad++ Notepad++ prior to 8.9.7.

Is there a fix for CVE-2026-52886?

A patch was published on 2026-07-14: v8.9.7 released with path normalization fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52886 attacked?

It is attacked with local access.

Am I affected by CVE-2026-52886?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52886: Notepad++ path traversal via session.xml backupFilePath

CVE-2026-52886 · Severity: info · Published 2026-08-17

Notepad++ is a free source code editor used by programmers to write and edit code. Prior to version 8.9.7, the application failed to properly validate file paths when restoring backed-up sessions, allowing an attacker to craft a malicious session file that reads arbitrary files from a user's computer and displays them in the editor. An attacker could exploit this to access sensitive files like passwords, configuration files, or other user data.

Quick answers

Is CVE-2026-52886 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52886 being exploited in the wild.
How severe is CVE-2026-52886?: Informational severity, published 17 August 2026.
Which products and versions are affected?: Notepad++ Notepad++ prior to 8.9.7.
Is there a fix for CVE-2026-52886?: A patch was published on 2026-07-14: v8.9.7 released with path normalization fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52886 attacked?: It is attacked with local access.
Am I affected by CVE-2026-52886?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in Notepad++'s session restoration logic. The application validates the backupFilePath attribute from session.xml using std::wstring::starts_with() to ensure paths stay within the backup directory, but fails to normalize file paths before validation. This allows an attacker to bypass the check using parent-directory sequences (e.g., "../") during snapshot-mode restoration. An attacker with the ability to modify or supply a malicious session.xml file can cause Notepad++ to load and display arbitrary user-readable files outside the intended backup directory. The vulnerability requires local file system access or the ability to modify the session.xml configuration file. This issue was fixed in version 8.9.7 by implementing proper path normalization during session file loading.

Affected products

Notepad++ Notepad++ prior to 8.9.7

Timeline

2026-08-17: disclosed
2026-07-14: patched: v8.9.7 released with path normalization fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.