A path traversal vulnerability in the kitty graphics protocol handler of rio-vt allows an attacker to delete and read files outside the intended temporary directory. The flaw arises because the handler only checks if the file path contains a specific substring without rejecting directory traversal sequences, enabling escape from the temp directory. This affects any application using rio-vt that renders untrusted output. The vulnerability is fixed in rio-vt version 0.5.29.