CyberRota Analysis
AI-GeneratedNotepad++ versions prior to 8.9.7 are vulnerable due to improper validation in the WinGup decompress function, which allows untrusted ZIP entry names to overwrite DLL files in sibling plugin directories. This flaw can lead to the execution of arbitrary code when the affected plugin is loaded, posing a significant security risk. Users and organizations utilizing Notepad++ for development should prioritize upgrading to version 8.9.7 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.