The vulnerability (CVE-2026-54056) in kovidgoyal's kitty terminal affects versions 0.47.0 and 0.47.1 in the `kitten dnd` remote drag-and-drop staging process. When handling remote `text/uri-list` drops, the software stages files in a temporary directory but does not properly de-duplicate duplicate basenames on case-sensitive filesystems. An attacker can exploit this by first creating a staged symlink and then sending a same-name regular file. The write operation uses `openat` without the `O_NOFOLLOW` flag, causing the write to follow the symlink and overwrite or truncate arbitrary files outside the staging directory before final confirmation. This vulnerability is related to but distinct from a previous file-transfer symlink issue and was patched in version 0.47.2.

An attacker with the ability to perform remote drag-and-drop operations can cause arbitrary writable files of the local kitty user to be overwritten or truncated. This can lead to integrity loss of local files and potentially disrupt normal operations or escalate further attacks. The CVSS score of 7.6 reflects high severity with network attack vector, low attack complexity, requiring privileges and user interaction, and causing a partial integrity impact with low availability impact.

Version 0.47.2 of kitty contains a patch that fixes this vulnerability. Users should upgrade to version 0.47.2 or later to remediate the issue. No other official remediation or temporary fixes are documented. Until upgraded, users should avoid accepting remote drag-and-drop operations from untrusted sources.