The vulnerability arises from the WinGup plugin’s decompression routine, which concatenates ZIP entry names directly to the extraction path without checking for containment. A crafted ZIP file can include a path such as ../../mimeTools/mimeTools.dll, causing Notepad++ to overwrite a DLL in a plugin directory. When Notepad++ loads that plugin later, attacker‑controlled code can execute in the context of the application. This flaw is a classic path traversal (Zip Slip) attack that can compromise confidentiality, integrity, and availability by allowing arbitrary code execution. The weakness is identified as CWE‑22.

Vendors and products affected are Notepad++ versions prior to 8.9.7. Any system running Notepad++ 8.8.x or 8.9.x without the 8.9.7 update is vulnerable. The exact version list is not specified beyond the mention of all releases before 8.9.7.

The CVSS score of 8.1 classifies this as high severity, and the EPSS score is currently not available. The vulnerability is not listed in the CISA KEV catalog, but the lack of containment validation provides a straightforward exploitation path through a malicious ZIP file delivered locally. The attack likely requires a user to trigger the WinGup extraction process, so the exploitation vector is local or within a compromised user session, but the impact remains remote code execution when the application reloads the corrupted plugin.