CVE-2026-54056 is a CWE-59 (Improper Link Resolution Before File Access) vulnerability in the kitty terminal's `kitten dnd` remote drag-and-drop staging process. In versions 0.47.0 and 0.47.1, when handling remote `text/uri-list` drops, the software stages files in a temporary directory but does not properly de-duplicate duplicate basenames on case-sensitive filesystems. An attacker can exploit this by first creating a staged symlink and then sending a same-name regular file. The vulnerable file write operation uses `openat` without the `O_NOFOLLOW` flag, causing the symlink to be followed and allowing writes outside the staging directory. This can lead to overwriting or truncating arbitrary files writable by the local kitty user. The issue is distinct from a prior file-transfer symlink vulnerability and was fixed in version 0.47.2.

An attacker capable of initiating a remote drag-and-drop operation can cause arbitrary writable files on the local system to be overwritten or truncated by exploiting symlink following during file staging. This can lead to integrity loss of local files accessible by the kitty user. There is no direct confidentiality impact, but the integrity impact is high. Availability impact is low.

Version 0.47.2 of kitty patches this vulnerability. Users should upgrade to 0.47.2 or later to remediate the issue. Since this is not a cloud service, remediation requires updating the local software. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified.