PT-2026-25518 · Npm · Openclaw

Published 2026-03-04 · Updated 2026-03-04

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 data: URL in gateway responses.

Impact

• Confidentiality impact: local file read in the gateway process context.
• Exfiltration path: agents.list can return the resulting avatarUrl payload.

Affected Components

• src/gateway/session-utils.ts (resolveIdentityAvatarUrl)

Affected Packages / Versions

• Package: openclaw (npm)
• Introduced: v2026.1.21
• Affected published versions: <= 2026.2.21-2
• Planned patched version: 2026.2.22

Remediation

• Resolve workspace and avatar paths with realpath and enforce realpath containment.
• Open files with O NOFOLLOW when available.
• Compare pre-open and opened file identity (dev/ino) to block swap races.
• Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance.

Fix Commit(s)

• 3d0337504349954237d09e4d957df5cb844d5e77

OpenClaw thanks @aether-ai-agent for reporting.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

GHSA-9MPH-4F7V-FMVH

Affected Products

Openclaw

References · 4

• https://osv.dev/vulnerability/GHSA-9mph-4f7v-fmvh · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/3d0337504349954237d09e4d957df5cb844d5e77 · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-9mph-4f7v-fmvh · Note