Kitty, a GPU‑based terminal, contains a file‑overwrite flaw in the kitten dnd drag‑and‑drop staging mechanism. When a remote source delivers a text/uri‑list drop, Kitty stages the transfer in a temporary directory, but on case‑sensitive filesystems duplicate basenames are not merged. An attacker can first create a symlink inside the staging area and then submit a regular file with the same name. Because the write operation uses openat with O_RDWR|O_CREAT|O_TRUNC without the O_NOFOLLOW flag, the subsequent write follows the attacker‑created symlink and overwrites or truncates an arbitrary file that the local kitty user can write to. The vulnerability allows an attacker to modify any such file, potentially affecting configuration, source code, or other data, thereby imposing a serious integrity compromise. It is classified as CWE‑59 (Path Traversal).

The affected vendor is KovidGoyal, the product is Kitty. Versions 0.47.0 and 0.47.1 are vulnerable. The issue is resolved in 0.47.2 and later releases.

The CVSS score of 7.6 indicates a high impact vulnerability. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely but not impossible. The flaw is not listed in CISA’s KEV catalog. Exploitation requires a malicious drag‑and‑drop source to supply a text/uri‑list that targets the local Kitty session; therefore the attack vector is an indirect ability for a remote attacker to induce local file manipulation by a trusted user’s terminal.