
Proof-of-concept exploit for CVE-2026-48778, demonstrating arbitrary code execution in Notepad++ ≤ 8.9.6 via the 'Open Containing Folder' feature. Published for educational research.
Severity: High (CVSS 7.8) | Affected: Notepad++ ≤ 8.9.6 | Patched: v8.9.6.1
A PoC script for CVE-2026-48778, an arbitrary code execution vulnerability in Notepad++ ≤ 8.9.6.
For full technical details, see the official security advisory.
python cve-2026-48778.py
Trigger after running: File → Open Containing Folder → cmd
Expected result: calc.exe launches instead of cmd.
Kavin Jindal — Avyukt Security || LinkedIn
This PoC is published for educational and research purposes only. Use only on systems you own or have explicit permission to test.