GHSA-7xr2-q9vf-x4r5: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

Summary

The patch for CVE-2026-32013 added symlink resolution and workspace boundary checks to agents.files.get and agents.files.set, but the agents.create and agents.update handlers in src/gateway/server-methods/agents.ts still call fs.appendFile on IDENTITY.md with no symlink containment check. An attacker who can plant a symlink in the agent workspace can redirect that write to an arbitrary file, such as /etc/crontab, and inject agent name, emoji and avatar content into it.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News
• MediumOn the hunt for ARTEX: understanding agentic attacks in AWS environmentsSimilar attack · Datadog Security Labs
• CriticalCVE-2026-102895: GPUStack Improper Authentication VulnerabilitySimilar attack · CISA Known Exploited Vulnerabilities
• HighCVE-2026-97677: IBM Langflow OSS arbitrary file write and read by authenticated flow authorsSimilar attack · NVD/CVE Database