Mintplex-Labs/anything-llm · error · Error

Invalid file location.

Error message

Invalid file location.

What it means

Thrown inside moveProcessedDocsToFolder()'s per-document loop when either the computed sourcePath or destinationPath is not within basePath. Each document's location comes from the collector; if a doc.location is malformed (absolute, traversal-bearing, or already nested), the rename would move a file across the trust boundary, so the operation is aborted. This protects both reads (source) and writes (destination).

Source

Thrown at server/utils/files/index.js:739

  const targetFolderPath = path.join(basePath, folder);
  if (!isWithin(path.resolve(basePath), path.resolve(targetFolderPath)))
    throw new Error("Invalid folder name.");
  if (!fs.existsSync(targetFolderPath))
    fs.mkdirSync(targetFolderPath, { recursive: true });

  for (const doc of documents) {
    const currentFolder = path.dirname(doc.location);
    if (currentFolder === folder) continue;

    const sourcePath = path.join(basePath, normalizePath(doc.location));
    const destinationPath = path.join(
      targetFolderPath,
      path.basename(doc.location)
    );

    if (!isWithin(basePath, sourcePath) || !isWithin(basePath, destinationPath))
      throw new Error("Invalid file location.");

    fs.renameSync(sourcePath, destinationPath);
    doc.location = path.join(folder, path.basename(doc.location));
    doc.name = path.basename(doc.location);
  }

  return folder;
}

/**
 * Purges the entire vector-cache folder and recreates it.
 * @returns {void}
 */
function purgeEntireVectorCache() {
  fs.rmSync(vectorCachePath, { recursive: true, force: true });
  fs.mkdirSync(vectorCachePath);
  return;
}

View on GitHub (pinned to 526360e320)

Solutions

1. Inspect the failing document's location field in the documents array and correct the record.
2. Ensure collector output uses relative, single-segment-prefixed locations (folder/file.json).
3. Run a data audit: SELECT docs whose location starts with '/' or contains '..' and repair them.
4. Wrap the call in try/catch at the endpoint and return 422 with the offending doc identifier for triage.

Example fix

// before
for (const doc of documents) {
  // ... builds sourcePath / destinationPath, throws if escapes
}

// after
for (const doc of documents) {
  if (!doc.location || path.isAbsolute(doc.location) || doc.location.includes('..')) {
    throw new UserError(`Refusing to move doc with unsafe location: ${doc.location}`, 422);
  }
  // ... safe to proceed
}

for (const doc of documents) {
  if (!doc.location || path.isAbsolute(doc.location) || doc.location.includes('..'))
    throw new UserError(`Unsafe doc.location: ${doc.location}`, 422);
}

function isRelativeDocLocation(doc: any): doc is { location: string; name: string } {
  return !!doc && typeof doc.location === 'string'
    && !path.isAbsolute(doc.location) && !doc.location.includes('..');
}

try {
  await moveProcessedDocsToFolder(docs, folderName);
} catch (e) {
  if (e.message === 'Invalid file location.') return res.status(422).json({ error: e.message });
  throw e;
}

When it happens

Trigger: A document in the `documents` array whose location is an absolute path, contains '..', or points outside documentsPath; a destination collision where path.basename produces a value that, when joined under the target folder, leaves basePath (rare, but possible with odd doc.location values).

Common situations: Stale or hand-edited document records whose location field was tampered with; a collector version that returned full paths instead of relative ones; concurrent uploads where one doc's location was rewritten mid-loop.

Related errors

• Invalid path.
• Invalid path name
• Invalid folder name.
• Invalid path.
• Invalid file path.

AI-assisted analysis of Mintplex-Labs/anything-llm@526360e320 (2026-08-13). Data as JSON: /api/errors/cd74bd6acdb4fc46. Report an issue: GitHub.