[openclaw] OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write

**[openclaw] OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write**

Impact The gateway agents.files.get and agents.files.set methods allowed symlink traversal for allowlisted workspace files. A symlinked allowlisted file (for example AGENTS.md) could resolve outside the agent workspace and be read/written by the gateway process. This could enable arbitrary host file read/write within the gateway process permissions, and chained impact up to code execution depending on which files are overwritten. Affected Packages / Versions Package: openclaw (npm) Affected versions: <= 2026.2.24 Latest published vulnerable version at patch time: 2026.2.24 Patched versions: >= 2026.2.25 Remediation agents.files now resolves real workspace paths, enforces containment for resolved targets, rejects out-of-workspace symlink targets, and keeps in-workspace symlink targets supported. The patch also adds gateway regression tests for blocked escapes and valid in-workspace symlink behavior...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.