Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows… (CVE-2026-80430)

CVE-2026-80430 describes an improper link resolution vulnerability in kitty's drag and drop protocol implementation affecting versions from 0.47.0 before 0.49.0. The function subdir_data_for_drag() resolves descendant paths by string construction and opening directories with safe_open rather than walking the tree component-by-component. This allows a crafted client to declare two entries with the same name where the first is a symlink to an arbitrary absolute path and the second a directory. The code ignores mkdirat() failure with EEXIST, causing subsequent path resolution to follow the symlink outside the staging directory. This directory descriptor is then used for file and directory creation operations, enabling creation at any path writable by the user. Entry names are sanitized but symlink targets are not, and files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, preventing overwriting existing files but allowing creation of new files and directories with mode 0755.

An attacker able to write to the terminal can create files and directories at arbitrary locations writable by the user running kitty, potentially leading to unauthorized file creation outside the intended staging area. Existing files cannot be overwritten, but new files and directories can be created, which may be used to escalate privileges or disrupt system operation depending on the context and permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when running untrusted programs that write to the terminal and avoid using vulnerable kitty versions in untrusted environments.