CVE-2026-80430— Kitty拖放协议链接解析不当导致任意文件创建漏洞
一分钟漏洞结论
影响对象
Kovid Goyal kitty
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 kitty 终端模拟器版本 0.47.0 至 0.49.0（不含 0.49.0）中，拖放协议（drag and drop protocol）的拖放源暂存路径存在文件访问前链接解析不当的安全漏洞。该漏洞允许向终端写入数据的程序在暂存目录之外的路径创建文件和目录。 具体来说， 中的 函数在解析暂存项子树时，是通过拼接路径字符串并使用 打开该路径，而不是逐个组件地遍历目录树。因此，如果客户端声明两个具有相同名称的条目：第一个是符号链接（symlink），其目标为任意绝对路径；第二个是目录，则 调用会因目标已存在（返回
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-80430 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory
来源: CVE Program / CVE List V5
Vulnerability Description
Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Kovid Goyal | kitty | 0.47.0 ~ 0.49.0 | - |
|
二、漏洞 CVE-2026-80430 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-80430 的情报信息
请登录查看更多情报信息。
CVE-2026-80430 其他参考 (4)
-
https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0 release-notes
-
https://secur0.com/en/cna/cve-list/cve-2026-80430-kitty-dnd-symlink-traversal third-party-advisory technical-description
同批安全公告 · Kovid Goyal · 2026-09-25 · 共 6 条
| CVE-2026-95832 | 9.3 CRITICAL | Kitty终端反射命令执行漏洞 |
| CVE-2026-80431 | 6.8 MEDIUM | Kitty 终端越界写入漏洞 |
| CVE-2026-80432 | 6.0 MEDIUM | Kitty拖放协议缺失授权漏洞 |
| CVE-2026-95835 | 5.6 MEDIUM | Kitty Askpass 共享内存对象所有权检查缺失漏洞 |
| CVE-2026-95834 | 4.6 MEDIUM | Kitty 拖拽协议释放后使用漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-80430
暂无评论