GHSA-9mph-4f7v-fmvh OpenClaw has agent avatar symlink traversal in gateway session metadata

Q: Which versions are affected by GHSA-9mph-4f7v-fmvh?

2 open source packages ship an affected version, including openclaw.

Q: Is GHSA-9mph-4f7v-fmvh being exploited?

There is no known exploitation of GHSA-9mph-4f7v-fmvh in the wild and no public exploit code.

Q: How do I fix GHSA-9mph-4f7v-fmvh?

Upgrade openclaw to 2026.2.22 or later.

Not scored Published 4 Mar 2026

An attacker can read arbitrary local files via symlink traversal in agent avatar paths, exposing sensitive data in gateway responses.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-9mph-4f7v-fmvh?

GHSA-9mph-4f7v-fmvh is a path traversal vulnerability in openclaw, published on 4 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Summary

A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 data: URL in gateway responses.

Impact

Confidentiality impact: local file read in the gateway process context.
Exfiltration path: agents.list can return the resulting avatarUrl payload.

Affected Components

src/gateway/session-utils.ts (resolveIdentityAvatarUrl)

Affected Packages / Versions

Package: openclaw (npm)
Introduced: v2026.1.21
Affected published versions: <= 2026.2.21-2
Planned patched version: 2026.2.22

Remediation

Resolve workspace and avatar paths with realpath and enforce realpath containment.
Open files with O_NOFOLLOW when available.
Compare pre-open and opened file identity (dev/ino) to block swap races.
Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance.

Fix Commit(s)

3d0337504349954237d09e4d957df5cb844d5e77

OpenClaw thanks @aether-ai-agent for reporting.

Which versions are affected by GHSA-9mph-4f7v-fmvh?