OpenClaw has agent avatar symlink traversal in gateway session metadata

Summary

A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 data: URL in gateway responses.

Impact

• Confidentiality impact: local file read in the gateway process context.
• Exfiltration path: agents.list can return the resulting avatarUrl payload.

Affected Components

• src/gateway/session-utils.ts (resolveIdentityAvatarUrl)

Affected Packages / Versions

• Package: openclaw (npm)
• Introduced: v2026.1.21
• Affected published versions: <= 2026.2.21-2
• Planned patched version: 2026.2.22

Remediation

• Resolve workspace and avatar paths with realpath and enforce realpath containment.
• Open files with O_NOFOLLOW when available.
• Compare pre-open and opened file identity (dev/ino) to block swap races.
• Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance.

Fix Commit(s)

• 3d0337504349954237d09e4d957df5cb844d5e77

OpenClaw thanks @aether-ai-agent for reporting.