The vulnerable function isInTrustedDirectory in Notepad++ 8.9.6.1 fails to canonicalize the path before performing a prefix-based check. Because the check only compares the beginning of the path string, a crafted path that begins with a trusted directory followed by ..\\..\\ to an outside location passes the check. The application then calls ShellExecute on that path, allowing an attacker to run an arbitrary executable located outside of the trusted directories. If the user launches the crafted path through the Run dialog, the payload executes with the same privileges as Notepad++, potentially enabling data theft, tampering, or further lateral movement.

Vendor Notepad++ (notepad-plus-plus) is affected. The vulnerable release is version 8.9.6.1. The patch that introduces path canonicalization is included in version 8.9.6.2. No other versions or platforms are listed in the CVE data.

The CVSS score of 7.8 classifies this flaw as high severity, and the EPSS score is not available. Based on the description, the lack of a canonically checked path provides a realistic attack surface, and the likely attack vector is local: an attacker crafts a file name that uses the suffix traversal trick and leverages the Run command or a similar feature that invokes ShellExecute. Since the flaw depends on user‑initiated execution of the path, it requires user interaction but offers high impact if triggered. The vulnerability is not listed in the CISA KEV catalog.