CVE-2026-80430 (GCVE-0-2026-80430)
Vulnerability from cvelistv5
Published
2026-09-25 13:08
Modified
2026-09-25 15:29
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Summary
Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Kovid Goyal | kitty |
Version: 0.47.0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80430",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T15:27:29.989878Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T15:29:22.714Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "kitty",
"programFiles": [
"kitty/dnd.c"
],
"repo": "https://github.com/kovidgoyal/kitty",
"vendor": "Kovid Goyal",
"versions": [
{
"lessThan": "0.49.0",
"status": "affected",
"version": "0.47.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.49.0",
"versionStartIncluding": "0.47.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dar\u00edo Rivas Quero"
},
{
"lang": "en",
"type": "analyst",
"value": "Cristian Fern\u00e1ndez Cornejo"
},
{
"lang": "en",
"type": "analyst",
"value": "Xo\u00e1n M. Otero Jorge"
},
{
"lang": "en",
"type": "coordinator",
"value": "Secur0 CNA"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Kovid Goyal"
}
],
"datePublic": "2026-09-21T04:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because \u003ccode\u003esubdir_data_for_drag()\u003c/code\u003e in \u003ccode\u003ekitty/dnd.c\u003c/code\u003e resolves a descendant of the staged item tree by constructing a path string and opening it with \u003ccode\u003esafe_open(path, O_DIRECTORY | O_RDONLY, 0)\u003c/code\u003e rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes \u003ccode\u003emkdirat()\u003c/code\u003e to fail with \u003ccode\u003eEEXIST\u003c/code\u003e, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the \u003ccode\u003edirfd\u003c/code\u003e argument to \u003ccode\u003eadd_payload()\u003c/code\u003e and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with \u003ccode\u003eO_CREAT | O_WRONLY | O_EXCL\u003c/code\u003e at mode \u003ccode\u003e0644\u003c/code\u003e, so existing files cannot be overwritten, and directories are created with \u003ccode\u003emkdirat()\u003c/code\u003e at mode \u003ccode\u003e0755\u003c/code\u003e, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory."
}
],
"value": "Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory."
}
],
"impacts": [
{
"capecId": "CAPEC-132",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-132 Symlink Attack"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:08:13.165Z",
"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"shortName": "Secur0"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/kovidgoyal/kitty/commit/554908ed0b4d010cf9821c75449c7f7c79a6170a"
},
{
"tags": [
"related"
],
"url": "https://github.com/kovidgoyal/kitty/commit/3c3133d3399257492347f535d8d191680803b25d"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0"
},
{
"tags": [
"third-party-advisory",
"technical-description"
],
"url": "https://secur0.com/en/cna/cve-list/cve-2026-80430-kitty-dnd-symlink-traversal"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to kitty 0.49.0 or later."
}
],
"value": "Upgrade to kitty 0.49.0 or later."
}
],
"source": {
"discovery": "INTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"assignerShortName": "Secur0",
"cveId": "CVE-2026-80430",
"datePublished": "2026-09-25T13:08:13.165Z",
"dateReserved": "2026-08-26T10:49:00.437Z",
"dateUpdated": "2026-09-25T15:29:22.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-80430\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-25T15:27:29.989878Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-25T15:29:13.963Z\"}}], \"cna\": {\"tags\": [\"x_open-source\"], \"title\": \"Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Dar\\u00edo Rivas Quero\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Cristian Fern\\u00e1ndez Cornejo\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Xo\\u00e1n M. Otero Jorge\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Secur0 CNA\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Kovid Goyal\"}], \"impacts\": [{\"capecId\": \"CAPEC-132\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-132 Symlink Attack\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 4.6, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/kovidgoyal/kitty\", \"vendor\": \"Kovid Goyal\", \"product\": \"kitty\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.47.0\", \"lessThan\": \"0.49.0\", \"versionType\": \"semver\"}], \"programFiles\": [\"kitty/dnd.c\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to kitty 0.49.0 or later.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Upgrade to kitty 0.49.0 or later.\", \"base64\": false}]}], \"datePublic\": \"2026-09-21T04:01:00.000Z\", \"references\": [{\"url\": \"https://github.com/kovidgoyal/kitty/commit/554908ed0b4d010cf9821c75449c7f7c79a6170a\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/kovidgoyal/kitty/commit/3c3133d3399257492347f535d8d191680803b25d\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0\", \"tags\": [\"release-notes\"]}, {\"url\": \"https://secur0.com/en/cna/cve-list/cve-2026-80430-kitty-dnd-symlink-traversal\", \"tags\": [\"third-party-advisory\", \"technical-description\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because \u003ccode\u003esubdir_data_for_drag()\u003c/code\u003e in \u003ccode\u003ekitty/dnd.c\u003c/code\u003e resolves a descendant of the staged item tree by constructing a path string and opening it with \u003ccode\u003esafe_open(path, O_DIRECTORY | O_RDONLY, 0)\u003c/code\u003e rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes \u003ccode\u003emkdirat()\u003c/code\u003e to fail with \u003ccode\u003eEEXIST\u003c/code\u003e, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the \u003ccode\u003edirfd\u003c/code\u003e argument to \u003ccode\u003eadd_payload()\u003c/code\u003e and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with \u003ccode\u003eO_CREAT | O_WRONLY | O_EXCL\u003c/code\u003e at mode \u003ccode\u003e0644\u003c/code\u003e, so existing files cannot be overwritten, and directories are created with \u003ccode\u003emkdirat()\u003c/code\u003e at mode \u003ccode\u003e0755\u003c/code\u003e, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-59\", \"description\": \"CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"0.49.0\", \"versionStartIncluding\": \"0.47.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"4daa8cea-433a-44bd-9456-53b127fc289a\", \"shortName\": \"Secur0\", \"dateUpdated\": \"2026-09-25T13:08:13.165Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-80430\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-25T15:29:22.714Z\", \"dateReserved\": \"2026-08-26T10:49:00.437Z\", \"assignerOrgId\": \"4daa8cea-433a-44bd-9456-53b127fc289a\", \"datePublished\": \"2026-09-25T13:08:13.165Z\", \"assignerShortName\": \"Secur0\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…