What survives an uninstall

The uninstaller keeps user data by default (uninstall.nsh, $keepUserData). In a normal profile that means these stay on disk after uninstall:

• %APPDATA%\Notepad++\config.xml - includes suppress2GBWarning, largeFileRestriction
• %APPDATA%\Notepad++\shortcuts.xml - shortcut and command bindings
• %APPDATA%\Notepad++\session.xml - the last-open file list

All three are in a user-writable directory, and they are read again after reinstall.

Why that matters

“Uninstall and reinstall” is the first thing people do when they suspect something is wrong with the program. But:

1. session.xml is a known input surface. A crafted entry with an unreachable UNC path hangs startup for 40+ seconds and triggers an outbound SMB authentication attempt (reported separately: #18548, #18553). A “clean reinstall” does not remove it.
2. shortcuts.xml binds commands to keys. A malicious entry is not removed either - it just stops working while the app is uninstalled, and starts working again after reinstall.
3. config.xml holds user-tunable safety switches (e.g. suppress2GBWarning). Those survive too.

So for anyone who got a bad config written (by malware, or by a family member clicking something), the standard “reinstall” advice does not clean it. The user believes they wiped it; they did not.

What would help

• An explicit “remove user config” option in the uninstaller (keep-by-default is fine, but make the choice visible)
• Documenting the config directory so users can delete it manually
• Optionally: a “reset settings” entry in the app itself

Disclosure

Limited public note, not a CVE request. This is a “by design” behavior with a real consequence: the reinstall people rely on does not remove the config that can hurt them. Not asking anyone to change the default - asking for the choice to be visible.