CVE-2026-57233

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57233
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57233.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57233
Aliases
  • GHSA-hjxw-84rf-wg5r
Published
2026-08-17T20:10:37.698Z
Modified
2026-08-20T10:17:16.452700Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
Summary
Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
Details

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57233.json"
}
References

Affected packages

Git / github.com/notepad-plus-plus/notepad-plus-plus

Affected ranges

Type
GIT
Repo
https://github.com/notepad-plus-plus/notepad-plus-plus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6634650414ff91220a4c353b7fe5ad741af0f9f9
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.9.7"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/notepad-plus-plus/wingup
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7670296a5c7fdec624e0a45dbde51059a7d735a8
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

7.*
7.2.2
7.3.1
Other
v4
v6
v7
v8
v4.*
v4.1
v4.2
v5.*
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.1
v5.1.1
v5.1.3
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v5.2.5
v5.2.6
v5.2.7
v5.2.8
v5.2.9
v5.3
v5.3.1
v5.3.2
v5.3.4
v5.3.5
v5.3.6
v5.3.7
v5.3.8
v5.3.9
v5.4
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.5
v5.5.1
v5.6
v5.6.1
v5.6.2
v5.6.3
v5.6.4
v5.6.5
v5.6.6
v5.6.7
v5.6.8
v5.7
v5.8
v5.8.1
v5.8.2
v5.8.3
v5.8.4
v5.8.5
v5.8.6
v5.8.7
v5.9
v5.9.1
v5.9.2
v5.9.3
v5.9.4
v5.9.5
v5.9.6
v5.9.6.1
v5.9.6.2
v5.9.7
v5.9.8
v6.*
v6.1
v6.1.1
v6.1.2
v6.1.3
v6.1.4
v6.1.5
v6.1.6
v6.1.7
v6.1.8
v6.2
v6.2.1
v6.2.2
v6.2.3_-_End_of_World_Edition
v6.3
v6.3.1
v6.3.2
v6.3.3
v6.4
v6.4.1
v6.4.2
v6.4.3
v6.4.4
v6.4.5
v6.5
v6.5.1
v6.5.2
v6.5.3
v6.5.4
v6.5.5
v6.6
v6.6.1
v6.6.2
v6.6.3
v6.6.4
v6.6.6_-_Friday_the_13th_edition
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7.1
v6.7.2
v6.7.3
v6.7.4_-_Je_suis_Charlie_edition
v6.7.5
v6.7.7
v6.7.8
v6.7.8.1
v6.7.8.2
v6.7.9
v6.7.9.1
v6.7.9.2
v6.8
v6.8.1
v6.8.2
v6.8.3
v6.8.4
v6.8.5
v6.8.6
v6.8.7
v6.8.8
v6.8.9
v6.9
v6.9.1
v6.9.2
v7.*
v7.1
v7.2
v7.2.1
v7.2.2
v7.3
v7.3.1
v7.3.2
v7.3.3
v7.4
v7.4.1
v7.4.2
v7.5.1
v7.5.2
v7.5.3
v7.5.4
v7.5.5
v7.5.6
v7.5.7
v7.5.8
v7.5.9
v7.6
v7.6.1
v7.6.2
v7.6.3
v7.6.4
v7.6.5
v7.6.6
v7.7
v7.7.1
v7.8
v7.8.1
v7.8.2
v7.8.3
v7.8.4
v7.8.5
v7.8.6
v7.8.7
v7.8.8
v7.8.9
v7.9
v7.9.1
v7.9.2
v7.9.3
v7.9.4
v7.9.5
v8.*
v8.1
v8.1.1
v8.1.2
v8.1.3
v8.1.4
v8.1.5
v8.1.6
v8.1.7
v8.1.8
v8.1.9
v8.1.9.1
v8.1.9.2
v8.1.9.3
v8.2
v8.2.1
v8.3
v8.3.1
v8.3.2
v8.3.3
v8.4
v8.4.1
v8.4.2
v8.4.3
v8.4.4
v8.4.5
v8.4.6
v8.4.7
v8.4.8
v8.4.9
v8.5
v8.5.1
v8.5.2
v8.5.3
v8.5.4
v8.5.5
v8.5.6
v8.5.7
v8.5.8
v8.6
v8.6.1
v8.6.2
v8.6.3
v8.6.4
v8.6.5
v8.6.6
v8.6.7
v8.6.8
v8.6.9
v8.7
v8.7.1
v8.7.2
v8.7.3
v8.7.4
v8.7.5
v8.7.6
v8.7.7
v8.7.8
v8.7.9
v8.8
v8.8.1
v8.8.2
v8.8.3
v8.8.4
v8.8.5
v8.8.6
v8.8.7
v8.8.8
v8.8.9
v8.9
v8.9.1
v8.9.2
v8.9.3
v8.9.4
v8.9.5
v8.9.6
v8.9.6.1
v8.9.6.2
v8.9.6.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57233.json"
vanir_signatures 
[
    {
        "target": {
            "function": "decompress",
            "file": "src/winmain.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/notepad-plus-plus/wingup/commit/7670296a5c7fdec624e0a45dbde51059a7d735a8",
        "id": "CVE-2026-57233-21266b00",
        "signature_version": "v1",
        "digest": {
            "length": 2237.0,
            "function_hash": "169323833541709493284522899890746305713"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "AboutDlg::run_dlgProc",
            "file": "PowerEditor/src/WinControls/AboutDlg/AboutDlg.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/6634650414ff91220a4c353b7fe5ad741af0f9f9",
        "id": "CVE-2026-57233-77046d11",
        "signature_version": "v1",
        "digest": {
            "length": 2313.0,
            "function_hash": "321789678466323583525587903832696399039"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "PowerEditor/src/WinControls/AboutDlg/AboutDlg.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/6634650414ff91220a4c353b7fe5ad741af0f9f9",
        "id": "CVE-2026-57233-de8dc4ca",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "73934179812655448165055737310699482624",
                "165596075505432413455088505965299296812",
                "15697846664367097651332048867224774793",
                "327363084166932039838311470772824169691",
                "27658911648692079515982892510481891031"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "src/winmain.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/notepad-plus-plus/wingup/commit/7670296a5c7fdec624e0a45dbde51059a7d735a8",
        "id": "CVE-2026-57233-f0b3d82d",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "314407321131039278628073492534505858913",
                "227176457769990210276831407942017984137",
                "174145186401954165019932825963215577402",
                "110081486140871945433109951405809467184",
                "149367707345767057578135467637212135257",
                "79730008289902968687543701463571814211"
            ]
        },
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-08-20T10:17:16Z"