Openclaw cli: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013) (CVE-2026-35632)

The patch for CVE-2026-32013 fixed symlink resolution for agents.files.get and agents.files.set but did not address agents.create and agents.update handlers in OpenClaw CLI. These handlers use fs.appendFile on IDENTITY.md without symlink containment checks, allowing an attacker who can plant a symlink in the agent workspace to cause arbitrary file append operations outside the workspace. The vulnerability arises because fs.appendFile follows symlinks by default, and the ensureAgentWorkspace function silently ignores EEXIST errors if a symlink exists, leading to writes to attacker-controlled paths. Proof-of-concept demonstrates appending attacker-controlled metadata to arbitrary files, including sensitive system files, enabling remote code execution or unauthorized access.

An attacker with the ability to place a symlink in the agent workspace can append attacker-controlled content to arbitrary files on the system via the agents.create or agents.update API endpoints. This can lead to remote code execution (e.g., by modifying /etc/crontab), persistent code execution on user login (e.g., by modifying ~/.bashrc), unauthorized SSH access (e.g., by modifying ~/.ssh/authorized_keys), or service disruption by altering application configuration files. The vulnerability allows integrity compromise of critical files through symlink traversal.

A patch is available that blocks symlink traversal in the agents.create and agents.update handlers by verifying and preventing writes through symlinks. Users should upgrade to version 2026.2.23 or later. Until patched, avoid allowing untrusted users to create or control files in the agent workspace directory. The vendor advisory confirms the availability of an official fix.