This vulnerability allows a local attacker to read any file that a user can read on the same system. By manipulating the backupFilePath attribute within session.xml, the attacker can construct a path with parent‑directory sequences that bypasses the intended backup directory check. When Notepad++ restores a session, the unnormalized path causes the application to open the targeted file in a new editor tab, exposing its contents without any authentication or elevated rights. The weakness is a classic path traversal flaw (CWE‑22) that jeopardizes confidentiality rather than granting code execution or termination of services.

The flaw is present in all releases of Notepad++ older than version 8.9.7. All users running 8.9.6 and earlier are susceptible. Version 8.9.7 and later include the fix that correctly normalises the path before validating it.

The CVSS score of 5.1 indicates a moderate impact when the flaw is exploited. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting low to moderate exploitation likelihood in the wild. The attack vector requires local access to the user’s session.xml file and the ability to influence its contents, so the risks are confined to environments where the user’s account can modify that file or to persistent malware that writes malicious entries to it.