CVE-2026-25926

Katalog CVE

CVSS 7.3 · High EPSS 0,21%

Kerentanan Untrusted Search Path pada notepad-plus-plus notepad++. Skor CVSS 3.1 7.3 (High) menurut github.com.

Deskripsi (NVD)

Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue.

Rincian

Terbit di NVD

19 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-426: Untrusted Search Path

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-rjvm-fcxw-2jxq exploit · advisory vendor
• https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.2 product · release notes
• https://notepad-plus-plus.org/news/v892-released press/media coverage