Mintplex-Labs/anything-llm · error

Failed to create folder: ${e.message}

Error message

Failed to create folder: ${e.message} 

What it means

Catch-all 500 for POST /document/create-folder wrapping everything outside the duplicate check: the explicit throw new Error('Invalid folder name.') when normalizePath(name) escapes documentsPath (isWithin guard), and any fs.mkdirSync failure (EACCES, EROFS, ENOSPC, illegal characters on the host OS). The underlying e.message is appended after the prefix.

Source

Thrown at server/endpoints/document.js:36

      try {
        const { name } = reqBody(request);
        const storagePath = path.join(documentsPath, normalizePath(name));
        if (!isWithin(path.resolve(documentsPath), path.resolve(storagePath)))
          throw new Error("Invalid folder name.");

        if (fs.existsSync(storagePath)) {
          response.status(500).json({
            success: false,
            message: "Folder by that name already exists",
          });
          return;
        }

        fs.mkdirSync(storagePath, { recursive: true });
        response.status(200).json({ success: true, message: null });
      } catch (e) {
        console.error(e);
        response.status(500).json({
          success: false,
          message: `Failed to create folder: ${e.message} `,
        });
      }
    }
  );

  app.post(
    "/document/move-files",
    [validatedRequest, flexUserRoleValid([ROLES.admin, ROLES.manager])],
    async (request, response) => {
      try {
        const { files } = reqBody(request);
        const docpaths = files.map(({ from }) => from);
        const documents = await Document.where({ docpath: { in: docpaths } });

        const embeddedFiles = documents.map((doc) => doc.docpath);
        const moveableFiles = files.filter(

View on GitHub (pinned to 3aec848f28)

Solutions

1. Read the suffix after 'Failed to create folder:' — it names the real cause ('Invalid folder name.', EACCES, ENOSPC...)
2. If 'Invalid folder name.', strip '../' and absolute-path segments from name and retry
3. If EACCES/EROFS, fix ownership/permissions of documentsPath or remount the volume read-write
4. If ENOSPC, free disk space on the storage volume

Example fix

// before
const name = rawName; // may contain '../'
// after
const safeName = rawName.replace(/\.\.+/g, '.').replace(/^\/+/, '').trim();
if (!safeName || safeName.includes('/')) throw new Error('Invalid folder name.');

// Sanitize before sending
const safeName = name.replace(/\.\.+/g, '.').replace(/^\/+/, '').trim();
if (!safeName || safeName.includes('/') || safeName.includes('\\')) throw new Error('Invalid folder name');

function isSafeFolderName(name) {
  return typeof name === 'string' && name.trim().length > 0
    && !name.includes('..') && !path.isAbsolute(name);
}

try { await createFolder(name); } catch (e) {
  const cause = e.message.replace(/^Failed to create folder:\s*/, '');
  if (cause === 'Invalid folder name.') highlightNameInput();
  else if (/EACCES|EROFS/.test(cause)) alertAdmin('documents folder not writable');
}

When it happens

Trigger: name containing '../' segments or an absolute path that fails the isWithin(documentsPath) guard; mkdirSync hitting EACCES/EROFS because the documents folder is not writable; a name with characters illegal on the filesystem (e.g. ':' on Windows); disk full (ENOSPC).

Common situations: API consumers passing unsanitized names with traversal sequences; documents folder owned by another user after a container migration; read-only Docker volume mount for document storage.

Related errors

• Invalid path name
• Invalid folder name.
• Cannot copy symbolic link: ${source}. Symlinks are not allow
• Folder by that name already exists
• Internal Server Error

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/35528b1207878384. Report an issue: GitHub.