CVE-2026-52884Disclosure(notepad-plus-plus / notepad\+\+)

LOWCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch notepad-plus-plus notepad\+\+ systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\..\ after a trusted directory prefix passes the check while resolving to an untrusted location. The CVE-2026-48800 patch adds isInTrustedDirectory() validation in Command::run() (RunDlg.cpp) before calling ShellExecute(). This function checks whether the resolved executable path is under a trusted directory. This vulnerability is fixed in 8.9.6.2.

notepad-plus-plus CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-p58x-r3c9-x9p6

Weakness type (CWE)

CWE-42

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

notepad\+\+

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
8 mentions across 5 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 7 signals
Disclosure: 6 classified signals
Peaked 1d ago at 3 mentions (2026-06-27); latest day: 1
8 total mentions across 5 days

Affected systems

Vendors

notepad-plus-plus

Products

notepad\+\+

1 version affected across 1 product

Deep dive

Activity timeline8 mentions / 5d

Signal classification3 categories

Disclosure

675.0%

PoC

112.5%

Patch

112.5%

Referenced assets10 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-10	2	Disclosure1PoC1
2026-06-12	1	Disclosure1
2026-06-26	1	Disclosure1
2026-06-27	3	Disclosure3
2026-07-07	1	Patch1

Full discourse8 posts

CVE@CVEnew119d
Disclosure
CVE-2026-52884 Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based che… https://www.cve.org/CVERecord?id=CVE-2026-52884
Post summary
CVE‑2026‑52884 exposes a path‑handling flaw in Notepad++ v8.9.6.1, where isInTrustedDirectory() fails to canonicalize paths, enabling potential trusted‑directory bypass.
00010800
57.7K followersView on X
ToolsLib@ToolsLib134d
Disclosure
Notepad++ path traversal bypass can execute commands without a prompt (CVE-2026-52884) https://blog.toolslib.net/2026/06/12/notepad-plus-plus-cve-2026-52884-path-traversal-bypass/
Post summary
The tweet announces a new Notepad++ vulnerability (CVE‑2026‑52884) that allows a path‑traversal bypass to execute commands without a prompt, referencing a blog article for details.
0001030
542 followersView on X
Hacker News 20@betterhn20136d
Disclosure
Notepad++ Zero-Click RCE via Path Traversal (CVE-2026-52884) https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-p58x-r3c9-x9p6 (https://news.ycombinator.com/item?id=48473731)
Post summary
This post announces a newly discovered Notepad++ zero‑click RCE vulnerability (CVE-2026-52884) and provides a link to the official GitHub advisory.
1000080
3.0K followersView on X
Jim Rigney@RigneySec136d
PoC
Notepad++ Zero-Click RCE via Path Traversal (CVE-2026-52884) http://dlvr.it/TSywyb https://t.co/rVBOQPqGeJ
Post summary
The tweet announces the Notepad++ Zero-Click RCE vulnerability (CVE‑2026‑52884) and shares a link that likely contains PoC material, but it does not detail exploitation code, active attacks, or patches.
0100061
678 followersView on X
Lokesh Bohra@7okesh109d
Patch
📷 Heads up, Devs & SecOps! Notepad++ has a CRITICAL RCE vulnerability (CVE-2026-52884) exploit path traversal in its settings. Attackers can silently run payloads using configured shortcuts! Action Step: Update to the patched version IMMEDIATELY. Security requires constant vigilance 📷 #CyberSecurity #NotepadPlusPlus #InfoSec https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/ghsa-p58x-r3c9-x9p6
Post summary
Advisory alerts users to a critical RCE in Notepad++ and urges immediate patching.
0000083
184 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds119d
Disclosure
CVE-2026-52884 Path Traversal in Notepad++ v8.9.6.1 via Uncanonical Directory Validation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-52884
Post summary
The post announces CVE‑2026‑52884, describing a path traversal flaw in Notepad++ v8.9.6.1 due to insecure directory validation.
00000140
4.1K followersView on X
Infoflowcloud@infoflowcloud119d
Disclosure
🚨*CVE* CVE-2026-52884 Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based che… https://www.cve.org/CVERecord?id=CVE-2026-52884 ----- Traducción: CVE-2026-52884 Not… http://infoflow.cloud`
Post summary
The post identifies CVE‑2026‑52884 for Notepad++ v8.9.6.1, highlighting a path‑canonicalization flaw that could enable directory traversal attacks.
0000040
89 followersView on X
MalwareObserver@MalwareObserver119d
Disclosure
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-52884](https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6... https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4 #Vulnerability #CVE #ZeroDay
Post summary
The post announces CVE-2026-52884, referencing a GitHub commit, but provides no further technical details, PoC, or exploitation information.
0000041
6 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	notepad-plus-plus	notepad\+\+	8.9.6.1	-	-

Explore more

Back to dashboard notepad-plus-plus CVEs notepad\+\+ vulnerabilities

What researchers are saying

CVE-2026-52884

Jim Rigney[verified]@RigneySecPoC

The tweet announces the Notepad++ Zero-Click RCE vulnerability (CVE‑2026‑52884) and shares a link that likely contains PoC material, but it does not detail exploitation code, active attacks, or patches.

MalwareObserver[verified]@MalwareObserverDisclosure

The post announces CVE-2026-52884, referencing a GitHub commit, but provides no further technical details, PoC, or exploitation information.

CVE@CVEnewDisclosure

CVE‑2026‑52884 exposes a path‑handling flaw in Notepad++ v8.9.6.1, where isInTrustedDirectory() fails to canonicalize paths, enabling potential trusted‑directory bypass.

ToolsLib@ToolsLibDisclosure

The tweet announces a new Notepad++ vulnerability (CVE‑2026‑52884) that allows a path‑traversal bypass to execute commands without a prompt, referencing a blog article for details.

Hacker News 20@betterhn20Disclosure

This post announces a newly discovered Notepad++ zero‑click RCE vulnerability (CVE-2026-52884) and provides a link to the official GitHub advisory.

Lokesh Bohra@7okeshPatch

Advisory alerts users to a critical RCE in Notepad++ and urges immediate patching.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE‑2026‑52884, describing a path traversal flaw in Notepad++ v8.9.6.1 due to insecure directory validation.

Infoflowcloud@infoflowcloudDisclosure

The post identifies CVE‑2026‑52884 for Notepad++ v8.9.6.1, highlighting a path‑canonicalization flaw that could enable directory traversal attacks.