Security Advisory

CVE-2026-57233

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-17 20:10:37

Last updated 2026-08-18 18:53:27

Assigner GitHub_M

CVSS score 8.1

State PUBLISHED

Description

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.

← Browse all CVEs View on cve.org ↗