CVE-2026-80430

Name of the Vulnerable Software and Affected Versions kitty versions 0.47.0 through 0.48.x

Description Improper link resolution in the drag source staging path of the drag and drop protocol allows a program writing to the terminal to create files and directories outside the staging directory. This occurs because the subdir data for drag() function in kitty/dnd.c resolves descendants of the staged item tree by constructing a path string and opening it with safe open(path, O DIRECTORY | O RDONLY, 0) instead of walking the tree component by component. An attacker can declare two entries with the same name—first a symlink targeting an arbitrary absolute path and second a directory—causing mkdirat() to fail with EEXIST. The code ignores this failure, leading the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory. This descriptor is then passed as the dirfd argument to add payload() and used for all subsequent create operations. While entry names are sanitized, symlink targets are not validated. Files are created with O CREAT | O WRONLY | O EXCL at mode 0644, preventing the overwriting of existing files, but directories are created with mkdirat() at mode 0755, allowing the creation of new intermediate directories at any path writable by the user running the application, provided the symlink target is an existing directory.

Recommendations Update kitty to version 0.49.0 or later.