Summary
A high-severity path resolution flaw in Notepad++ can cause the Folder as Workspace "Run by system" action to select a different sibling file than the one the user intended to open. On supported Windows systems, an attacker who can place a specially named command script alongside a selected text file may cause that script to execute with the user's privileges.
Affected context
The issue occurs in Notepad++ versions before the fixed release when users work with files through Folder as Workspace and invoke the "Run by system" action on Windows 10 or Windows 11. Risk depends on an attacker being able to place or control files in a directory that the user browses and on the application resolving the requested file using an ambiguous or insufficiently validated name.
Exploit preconditions
- Attack surface: Notepad++ Folder as Workspace and its "Run by system" action
- Required access: Ability to place or control a command script in a directory visible to the target user
- Trigger point: The user invokes "Run by system" for a selected text file
- Platform condition: Windows 10 or Windows 11
- Why exploitation is possible: File resolution can select a sibling script based on a derived name rather than binding execution to the exact file selected by the user
Why this happens
The underlying bug is an incorrect name or reference resolution problem, mapping primarily to CWE-706: Use of Incorrectly-Resolved Name or Reference. The application derives or resolves a runnable path from user-selected file information without sufficiently ensuring that the resolved object is the exact intended file and has an appropriate type. This behavior is also related to CWE-20: Improper Input Validation, because file names and extensions are not adequately validated before the action chooses what to execute.
Potential impact
- An attacker-controlled command script may execute with the current user's privileges.
- The attacker could modify files accessible to that user.
- The issue could enable credential theft, persistence, or additional malware execution.
- User or organizational data may be exposed, altered, or deleted.
General mitigation guidance
Mitigation generally focuses on binding actions to canonical, user-selected file objects rather than reconstructing paths from display names or extensions.
Common defensive patterns include:
- Resolve and validate the canonical target before opening or executing it.
- Require an explicit, trusted executable-type association instead of inferring execution from a related filename.
- Reject ambiguous names, unexpected extensions, and sibling-file substitutions.
- Apply allowlists for executable file types and preserve the selected file identity through the action pipeline.
- Run user-facing editor processes with least privilege and avoid elevated execution contexts.
- Treat files in shared or attacker-writable directories as untrusted.
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis of code that reconstructs paths from filenames, extensions, or UI labels.
- Code review checks for file actions that do not preserve the identity of the selected object.
- Tests using same-stem files with different extensions in attacker-writable directories.
- Endpoint monitoring for unexpected command interpreters or scripts launched by the editor.
- Application policies that restrict execution of scripts from user-controlled and shared locations.
Automated code review and security testing tools may help identify path canonicalization and file-type validation gaps.
