MediumVulnerability
GHSA-9mph-4f7v-fmvh: OpenClaw has agent avatar symlink traversal in gateway session metadata
- Identifier
- GHSA-9mph-4f7v-fmvh
- Published
- Record updated
- Affected
- openclaw < 2026.2.22
- Fixed in
- 2026.2.22
- released February 22, 2026, 9 days before disclosure
Summary
A crafted local avatar path in OpenClaw's gateway can follow a symlink outside the agent workspace and return arbitrary file contents as a base64 data: URL. The flaw sits in resolveIdentityAvatarUrl in src/gateway/session-utils.ts, affects the openclaw npm package from v2026.1.21 through 2026.2.21-2, and allows local file read in the gateway process, which agents.list can return as avatarUrl.
Mitigation
Resolve workspace and avatar paths with realpath and enforce realpath containment. Open files with O_NOFOLLOW when available. Compare pre-open and opened file identity (dev/ino) to block swap races. Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance. Planned patched version: 2026.2.22.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online