GitHub Security Advisory: GHSA-7xr2-q9vf-x4r5
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.1)
CWE: CWE-61: UNIX Symbolic Link (Symlink) Following
Vulnerable versions: <= 2026.2.22
Patched in: unpatched

Summary: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

Details:
### Summary

The patch for CVE-2026-32013 introduced symlink resolution and workspace boundary enforcement for `agents.files.get` and `agents.files.set`. However, two other handlers in the same file (`agents.create` and `agents.update`) still use raw `fs.appendFile` on the `IDENTITY.md` file **without any symlink containment check**. An attacker who can place a symlink in the agent workspace can hijack the `IDENTITY.md` path to append attacker-controlled content to arbitrary files on the system.

### Details

In `src/gateway/server-methods/agents.ts`, the `agents.create` handler constructs the identity path and appends agent metadata without verifying symlinks:

```typescript
// agents.create — line 283-291
const identityPath = path.join(workspaceDir, DEFAULT_IDENTITY_FILENAME);
const lines = [
  "",
  `- Name: ${safeName}`,
  ...(emoji ? [`- Emoji: ${sanitizeIdentityLine(emoji)}`] : []),
  ...(avatar ? [`- Avatar: ${sanitizeIdentityLine(avatar)}`] : []),
  "",
];
await fs.appendFile(identityPath, lines.join("\n"), "utf-8"); // ← NO SYMLINK CHECK
```

The `agents.update` handler has the same issue at line 348-349:

```typescript
// agents.update — line 348-349
const identityPath = path.join(workspace, DEFAULT_IDENTITY_FILENAME);
await fs.appendFile(identityPath, `\n- Avatar: ${sanitizeIdentityLine(avatar)}\n`, "utf-8"); // ← NO SYMLINK CHECK
```

`fs.appendFile` follows symlinks by default. If the `IDENTITY.md` file in the workspace is a symlink pointing to a sensitive file (e.g., `/etc/crontab`, `~/.bashrc`, or `~/.ssh/authorized_keys`), calling `agents.create` will append the agent identity metadata to that file.

The `ensureAgentWorkspace` function (called at line 274 before the append) uses exclusive-create mode (`flag: 'wx'`) for `IDENTITY.md`. If a symlink already exists at that path, the `EEXIST` error is silently caught, and the subsequent `fs.appendFile` follows the symlink.

**Attack flow:**
```
1. Attacker plants symlink: workspace/IDENTITY.md → /etc/crontab
2. ensureAgentWorkspace skips creation (EEXIST from symlink)
3. fs.appendFile follows symlink → writes to /etc/crontab
4. Attacker-controlled content (name, emoji, avatar) injected into crontab → RCE
```

### PoC

**Prerequisites:** Docker and Python 3 installed.

**Step 1: Build and start the test environment.**
```bash
cd llm-enhance/cve-finding/RCE/CVE-2026-32013-identity-appendFile-variant-exp/
docker compose up -d --build
sleep 3
```

**Step 2: Run the exploit.**
```bash
python3 poc_exploit.py
```

This script:
1. Plants a symlink `IDENTITY.md → /etc/target-file.txt` inside the agent workspace
2. Calls the `agents.create` API endpoint via HTTP POST
3. Verifies that the agent identity metadata was appended to `/etc/target-file.txt`

**Step 3: Run the control experiment.**
```bash
python3 control-patched_realpath.py
```

**Step 4: Cleanup.**
```bash
docker compose down
```

### Log of Evidence

**Exploit output:**
```
=== CVE-2026-32013 Variant: Symlink Traversal via IDENTITY.md