CVE-2026-57233: Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Notepad++ (WinGup plugin)to a version that resolves this vulnerability.Fixed in 8.9.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57233?
CVE-2026-57233 has a high severity score of 8.1.
What does CVE-2026-57233 describe?
CVE-2026-57233 describes a path traversal vulnerability in Notepad++'s WinGup plugin that allows for unsafe file extraction.
How do I fix CVE-2026-57233?
To fix CVE-2026-57233, update Notepad++ to version 8.9.7 or later where the vulnerability is addressed.
What kind of attack can CVE-2026-57233 enable?
CVE-2026-57233 can enable an attacker to overwrite critical DLL files in sibling plugin directories through crafted ZIP files.
Who is affected by CVE-2026-57233?
Users of Notepad++ versions prior to 8.9.7 using the WinGup plugin are affected by CVE-2026-57233.