OpenClaw's avatar symlink traversal can expose out-of-workspace local files

Summary

OpenClaw avatar handling allowed a symlink traversal path that could expose local files outside an agent workspace through gateway avatar surfaces.

Affected Packages / Versions

• Package: openclaw (npm)
• Affected versions: <= 2026.2.21, plus prereleases 2026.2.21-1 and 2026.2.21-2
• Latest published version at triage time (2026-02-22): 2026.2.21-2 (affected)
• Planned patched version (pre-set for release workflow): 2026.2.22

Details

In vulnerable builds, local avatar resolution could follow symlinks and return file bytes from outside the configured workspace boundary.

The issue was hardened in two paths:

1. Gateway avatar metadata resolution now enforces canonical containment, O_NOFOLLOW, and fd/file-identity checks.
2. Control UI avatar serving now rejects symlink paths and enforces fd/file-identity and size checks before reads.

Fix Commit(s)

• 3d0337504349954237d09e4d957df5cb844d5e77
• 6970c2c2db3ee069ef0fff0ade5cfbdd0134f9d2

Release Process Note

patched_versions is pre-set to >= 2026.2.22 so after npm release, the remaining action is to publish this advisory.

Impact

Confidentiality impact only: local files readable by the OpenClaw process could be disclosed via avatar response surfaces.

OpenClaw thanks @tdjackey for reporting.