Vulnerability-Lookup

CVE-2026-80430 (GCVE-0-2026-80430)

Vulnerability from cvelistv5 – Published: 2026-09-25 13:08 – Updated: 2026-09-25 15:29 X_Open Source

Title

Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory

Summary

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory.

Severity

4.6 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-25 15:27 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

Secur0 INCIBE root

References

4 references

URL	Tags
https://github.com/kovidgoyal/kitty/commit/554908…	patch
https://github.com/kovidgoyal/kitty/commit/3c3133…	related
https://github.com/kovidgoyal/kitty/releases/tag/…	release-notes
https://secur0.com/en/cna/cve-list/cve-2026-80430…	third-party-advisorytechnical-description

Impacted products

1 product

Vendor	Product	Version	CPE status
Kovid Goyal	kitty	Affected: 0.47.0 , < 0.49.0 (semver) cpe:2.3:a:kovidgoyal:kitty::::::::

Date Public

2026-09-21 04:01

Credits

Darío Rivas Quero Cristian Fernández Cornejo Xoán M. Otero Jorge Secur0 CNA Kovid Goyal

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80430",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T15:27:29.989878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T15:29:22.714Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "kitty",
          "programFiles": [
            "kitty/dnd.c"
          ],
          "repo": "https://github.com/kovidgoyal/kitty",
          "vendor": "Kovid Goyal",
          "versions": [
            {
              "lessThan": "0.49.0",
              "status": "affected",
              "version": "0.47.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.49.0",
                  "versionStartIncluding": "0.47.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dar\u00edo Rivas Quero"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Cristian Fern\u00e1ndez Cornejo"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Xo\u00e1n M. Otero Jorge"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Secur0 CNA"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Kovid Goyal"
        }
      ],
      "datePublic": "2026-09-21T04:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because \u003ccode\u003esubdir_data_for_drag()\u003c/code\u003e in \u003ccode\u003ekitty/dnd.c\u003c/code\u003e resolves a descendant of the staged item tree by constructing a path string and opening it with \u003ccode\u003esafe_open(path, O_DIRECTORY | O_RDONLY, 0)\u003c/code\u003e rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes \u003ccode\u003emkdirat()\u003c/code\u003e to fail with \u003ccode\u003eEEXIST\u003c/code\u003e, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the \u003ccode\u003edirfd\u003c/code\u003e argument to \u003ccode\u003eadd_payload()\u003c/code\u003e and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with \u003ccode\u003eO_CREAT | O_WRONLY | O_EXCL\u003c/code\u003e at mode \u003ccode\u003e0644\u003c/code\u003e, so existing files cannot be overwritten, and directories are created with \u003ccode\u003emkdirat()\u003c/code\u003e at mode \u003ccode\u003e0755\u003c/code\u003e, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory."
            }
          ],
          "value": "Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-132",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-132 Symlink Attack"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T13:08:13.165Z",
        "orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
        "shortName": "Secur0"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kovidgoyal/kitty/commit/554908ed0b4d010cf9821c75449c7f7c79a6170a"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/kovidgoyal/kitty/commit/3c3133d3399257492347f535d8d191680803b25d"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://secur0.com/en/cna/cve-list/cve-2026-80430-kitty-dnd-symlink-traversal"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to kitty 0.49.0 or later."
            }
          ],
          "value": "Upgrade to kitty 0.49.0 or later."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
    "assignerShortName": "Secur0",
    "cveId": "CVE-2026-80430",
    "datePublished": "2026-09-25T13:08:13.165Z",
    "dateReserved": "2026-08-26T10:49:00.437Z",
    "dateUpdated": "2026-09-25T15:29:22.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "kitty",
                "programFiles": [
                  "kitty/dnd.c"
                ],
                "repo": "https://github.com/kovidgoyal/kitty",
                "vendor": "Kovid Goyal",
                "versions": [
                  {
                    "lessThan": "0.49.0",
                    "status": "affected",
                    "version": "0.47.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "4daa8cea-433a-44bd-9456-53b127fc289a"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory."
          }
        ],
        "id": "CVE-2026-80430",
        "lastModified": "2026-09-25T16:17:27.737",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 4.6,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "LOW",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-80430",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T15:27:29.989878Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-25T14:17:19.067",
        "references": [
          {
            "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
            "url": "https://github.com/kovidgoyal/kitty/commit/3c3133d3399257492347f535d8d191680803b25d"
          },
          {
            "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
            "url": "https://github.com/kovidgoyal/kitty/commit/554908ed0b4d010cf9821c75449c7f7c79a6170a"
          },
          {
            "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
            "url": "https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0"
          },
          {
            "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
            "url": "https://secur0.com/en/cna/cve-list/cve-2026-80430-kitty-dnd-symlink-traversal"
          }
        ],
        "sourceIdentifier": "4daa8cea-433a-44bd-9456-53b127fc289a",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-59"
              }
            ],
            "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-09-25T20:26:58+00:00",
      "cve": "CVE-2026-80430",
      "id": "CVE-2026-80430",
      "initial_release_date": "2026-09-25T13:08:13.165000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kitty: improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80430.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-80430

Vulnerability from fkie_nvd - Published: 2026-09-25 14:17 - Updated: 2026-09-25 16:17

Severity

4.6 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Summary

References

	URL	Tags
	4daa8cea-433a-44bd-9456-53b127fc289a	https://github.com/kovidgoyal/kitty/commit/3c3133d3399257492347f535d8d191680803b25d
	4daa8cea-433a-44bd-9456-53b127fc289a	https://github.com/kovidgoyal/kitty/commit/554908ed0b4d010cf9821c75449c7f7c79a6170a
	4daa8cea-433a-44bd-9456-53b127fc289a	https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0
	4daa8cea-433a-44bd-9456-53b127fc289a	https://secur0.com/en/cna/cve-list/cve-2026-80430-kitty-dnd-symlink-traversal

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "kitty",
          "programFiles": [
            "kitty/dnd.c"
          ],
          "repo": "https://github.com/kovidgoyal/kitty",
          "vendor": "Kovid Goyal",
          "versions": [
            {
              "lessThan": "0.49.0",
              "status": "affected",
              "version": "0.47.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "4daa8cea-433a-44bd-9456-53b127fc289a"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory."
    }
  ],
  "id": "CVE-2026-80430",
  "lastModified": "2026-09-25T16:17:27.737",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-80430",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-25T15:27:29.989878Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-25T14:17:19.067",
  "references": [
    {
      "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
      "url": "https://github.com/kovidgoyal/kitty/commit/3c3133d3399257492347f535d8d191680803b25d"
    },
    {
      "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
      "url": "https://github.com/kovidgoyal/kitty/commit/554908ed0b4d010cf9821c75449c7f7c79a6170a"
    },
    {
      "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
      "url": "https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0"
    },
    {
      "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
      "url": "https://secur0.com/en/cna/cve-list/cve-2026-80430-kitty-dnd-symlink-traversal"
    }
  ],
  "sourceIdentifier": "4daa8cea-433a-44bd-9456-53b127fc289a",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ],
      "source": "4daa8cea-433a-44bd-9456-53b127fc289a",
      "type": "Secondary"
    }
  ]
}

GHSA-PHG7-MGRC-J9PJ

Vulnerability from github – Published: 2026-09-25 15:31 – Updated: 2026-09-25 15:31

Details

Severity

4.6 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-80430"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-25T14:17:19Z",
    "severity": "MODERATE"
  },
  "details": "Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory.",
  "id": "GHSA-phg7-mgrc-j9pj",
  "modified": "2026-09-25T15:31:47Z",
  "published": "2026-09-25T15:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kovidgoyal/kitty/commit/3c3133d3399257492347f535d8d191680803b25d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kovidgoyal/kitty/commit/554908ed0b4d010cf9821c75449c7f7c79a6170a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0"
    },
    {
      "type": "WEB",
      "url": "https://secur0.com/en/cna/cve-list/cve-2026-80430-kitty-dnd-symlink-traversal"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-80430 (GCVE-0-2026-80430)

FKIE_CVE-2026-80430

GHSA-PHG7-MGRC-J9PJ

Tags

Sightings

Nomenclature

Related by attack behaviour