CVE-2026-80430

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in Kitty Terminal Emulator

Publication date: 2026-09-25

Last updated on: 2026-09-29

Assigner: Secur0

Description

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-29

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-80430

EUVD

EUVD-2026-87063

Affected Vendors & Products

Vendor	Product	Version / Range
kitty	kitty	to 0.49.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability in kitty terminal emulator (versions 0.47.0 to 0.49.0) involves improper path resolution during drag-and-drop operations. A malicious program can create files or directories outside the intended staging area by exploiting symlink targets. The issue occurs because the code resolves paths by string construction rather than safe tree traversal, allowing symlinks to redirect file creation to arbitrary locations.

Detection Guidance

This vulnerability can be detected by checking for suspicious file or directory creation outside expected staging paths in kitty versions 0.47.0 to 0.49.0. Review logs for mkdirat or open syscalls with paths outside the staging directory. Check for unexpected symlinks in drag-and-drop operations. Verify kitty version is not in the affected range.

Impact Analysis

If you use kitty terminal emulator in versions 0.47.0 to 0.49.0, an attacker could trick you into creating files or directories in unintended locations on your system. This could lead to data corruption, unauthorized file creation, or potential privilege escalation if combined with other vulnerabilities. The impact is limited to files writable by your user account.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized file and directory creation outside intended staging directories. It enables attackers to write files to arbitrary paths writable by the user running kitty, which may include sensitive data locations. This could lead to unauthorized data access, modification, or exfiltration, violating data integrity and confidentiality requirements.

Mitigation Strategies

Immediately upgrade kitty to version 0.49.0 or later to address the improper link resolution issue in the drag and drop protocol.

Hi! I’m here to help you understand CVE-2026-80430. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70