Link following in kitty - CVE-2026-54055
Published: September 22, 2026
Vulnerability identifier: #VU151619
CSH Severity: Medium
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54055
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to write to arbitrary user-writable files.
The vulnerability exists due to improper link resolution before file access in the DestFile.write_data() method of kitty/file_transmission.py when processing file transmission data after validating a destination path. A local user can create a symlink after the initial validation and send file transmission data to write through the symlink.
User interaction is required to confirm the file transfer.
Affected software
kitty
Debian Linux
Ubuntu
kitty (Ubuntu package)
kitty (Debian package)
Debian Linux
Ubuntu
kitty (Ubuntu package)
kitty (Debian package)
How to mitigate CVE-2026-54055
Install security update from vendor's website.
kitty - update to 0.47.2
kitty (Ubuntu package) - addressed in versions 0.32.2-1ubuntu0.4+esm2, 0.45.0-1ubuntu0.1~esm2
kitty (Debian package) - update to 0.41.1-2+deb13u2
kitty (Ubuntu package) - addressed in versions 0.32.2-1ubuntu0.4+esm2, 0.45.0-1ubuntu0.1~esm2
kitty (Debian package) - update to 0.41.1-2+deb13u2