Is CVE-2026-57233 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57233 being exploited in the wild.

How severe is CVE-2026-57233?

High severity, with a CVSS score of 8.1, published 17 August 2026.

Which products and versions are affected?

Notepad++ Notepad++ prior to 8.9.7.

Is there a fix for CVE-2026-57233?

A patch was published on 2026-07-14: Version 8.9.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57233 attacked?

It is attacked over the network.

Am I affected by CVE-2026-57233?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57233: Notepad++ path traversal in WinGup plugin extraction

CVE-2026-57233 · Severity: high · CVSS 8.1 · Published 2026-08-17

Notepad++ is a popular source code editor with automatic plugin update functionality. A flaw in the WinGup plugin installer allows attackers to craft a malicious plugin package that overwrites DLL files belonging to other installed plugins. When Notepad++ next loads the compromised plugin, attacker code executes with the privileges of the application, potentially including administrator level if Notepad++ is running elevated.

Quick answers

Is CVE-2026-57233 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57233 being exploited in the wild.
How severe is CVE-2026-57233?: High severity, with a CVSS score of 8.1, published 17 August 2026.
Which products and versions are affected?: Notepad++ Notepad++ prior to 8.9.7.
Is there a fix for CVE-2026-57233?: A patch was published on 2026-07-14: Version 8.9.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57233 attacked?: It is attacked over the network.
Am I affected by CVE-2026-57233?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a classic path traversal (ZIP Slip) flaw in the WinGup decompress() function used for plugin extraction. The vulnerable code joins untrusted ZIP entry filenames directly to the target directory without validating that the resulting path stays within the intended plugin folder. An attacker can create a ZIP archive with entries containing path traversal sequences (e.g., ../mimeTools/mimeTools.dll) that, when extracted, write files outside the target plugin directory and overwrite DLLs in sibling plugin folders. Exploitation requires only network access and user interaction (triggering a plugin update), with no authentication needed. The fix, released in version 8.9.7, validates ZIP entry paths before extraction to prevent directory traversal. Patch commits are available in the notepad-plus-plus repository.

Affected products

Notepad++ Notepad++ prior to 8.9.7

Timeline

2026-07-14: disclosed
2026-07-14: patched: Version 8.9.7 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.