Openclaw cli: OpenClaw has agent avatar symlink traversal in gateway session metadata

The OpenClaw CLI package (npm) has a symlink traversal vulnerability in the function resolveIdentityAvatarUrl within src/gateway/session-utils.ts. This flaw allows a crafted local avatar path to follow symlinks outside the intended agent workspace, causing arbitrary local files to be read and their contents returned as base64-encoded data URLs in gateway responses. The vulnerability affects versions introduced in 2026.1.21 and present in all published versions up to 2026.2.21-2. The planned fix involves resolving paths with realpath, enforcing containment within the workspace, opening files with O_NOFOLLOW, and verifying file identity to prevent race conditions. The fix commit is 3d0337504349954237d09e4d957df5cb844d5e77.

This vulnerability allows an attacker with local access to cause the gateway process to read arbitrary files on the local filesystem by exploiting symlink traversal in avatar path resolution. The confidentiality impact is high due to local file disclosure. The exfiltration vector is through the agents.list interface, which returns the avatarUrl payload containing the base64-encoded file contents. There is no indication of privilege escalation or remote exploitation without local access.

A patch is available and planned for OpenClaw CLI version 2026.2.22 that fixes the symlink traversal by enforcing realpath containment, using O_NOFOLLOW when opening files, and verifying file identity to prevent race conditions. Users should upgrade to version 2026.2.22 or later to remediate this vulnerability. Until patched, avoid using untrusted local avatar paths to prevent exploitation.