A flaw was found in kitty. An attacker running a program within the terminal can create arbitrary files and directories outside the staging area in any location writable by the user. This issue occurs because the drag-and-drop staging mechanism improperly resolves symbolic links (symlinks) pointing to external paths. By providing crafted drag-and-drop entries, the program can trick the terminal into following these links and creating new files and directories in unauthorized locations.
Last checked: 2026-10-03 05:12 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-25 15:27 UTC)
Fix evidence last checked: 2026-09-25 20:28 UTC