Summary

Notepad++ validates the backupFilePath attribute during session restoration using a raw string prefix comparison via std::wstring::starts_with(), without normalizing the path first. A crafted path that begins with the legitimate backup directory prefix but contains ..\ traversal sequences passes the check, yet resolves to an arbitrary location when the OS opens the file — loading the content of any readable file into an editor tab.

Technical Overview

On launch with snapshot (backup) mode enabled, Notepad++ restores the previous session from session.xml. Each entry's backupFilePath is expected to live under the application's backup directory. The integrity gate only checks that the stored path starts with the expected backup directory string. Because the comparison happens on the raw, un-normalized string, an attacker prepends the legitimate prefix and then walks out of the directory with ..\ sequences.

Root Cause

The check tests a textual prefix; the use opens the OS-resolved path. The two disagree once ..\ is present.

Attack Scenario

Pre-condition: Write access to session.xml, snapshot/backup mode enabled.

Steps:

1. Overwrite session.xml, injecting a crafted backupFilePath: <backupDir>\..\..\..\..\Users\victim\.ssh\id_rsa
2. The prefix <backupDir>\ satisfies starts_with(), so validation passes.
3. Launch Notepad++ (session restoration triggers).
4. The OS collapses the ..\ sequences; the target file is opened.
5. The content of the arbitrary file is loaded into an editor tab.

Result: Read-only exfiltration — target file content is visible in the editor, including sensitive files such as SSH keys, environment configuration files, and credential stores.

Impact

• Type: Arbitrary File Read (Path Traversal)
• Admin Required: No
• UAC Prompt: No
• Exposure: SSH private keys, .env / config files, credential stores — any file readable by the user
• CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)

Proof of Concept

Requirements:

• Notepad++ v8.9.6.2 portable x64 with backup/snapshot configuration
• Write access to session.xml
• A backupFilePath payload: backup directory prefix + ..\ traversal sequences + target file path

Injecting the crafted path and launching the application loads the target file into an editor tab.

Patch Analysis

The fix (commit 7e66f36) performs proper path normalization before validation, so ..\ sequences are collapsed prior to the prefix comparison — the checked path and the used path now agree.

References

• GHSA-rqfm-pw34-r7j6
• CVE-2026-52886
• Commit 7e66f36
• Notepad++ v8.9.7 release