Arbitrary file read via path traversal

Path traversal in session.xml handling in Notepad++ before 8.9.7 allows local users to read arbitrary user-readable files via backupFilePath. In NppParameters::getSessionFromXmlTree in Parameters.cpp, the backupFilePath attribute is checked with std::wstring::starts_with against the expected backup directory before canonicalization, so parent-directory segments survive the prefix test and are resolved by the OS when the file is opened. Exploitation requires write access to session.xml and snapshot mode on the next launch; the result is file disclosure in an editor tab, not file modification or code execution by this flaw alone.