What causes "Invalid folder name." in Mintplex-Labs/anything-llm?

Use a plain folder name without separators or '..': 'my-folder'.

Mintplex-Labs/anything-llm · warning · Error

Invalid folder name.

Error message

Invalid folder name.

What it means

Functionally identical to error 125 but thrown by the internal (non-v1-API) endpoint POST /document/create-folder used by the frontend UI. Same isWithin/normalizePath guard against the resolved folder path escaping documentsPath. The only difference is the error string ('Invalid folder name.' vs 'Invalid path name') and the auth middleware (flexUserRoleValid admin/manager rather than API key).

Source

Thrown at server/endpoints/document.js:22

const {
  flexUserRoleValid,
  ROLES,
} = require("../utils/middleware/multiUserProtected");
const { validatedRequest } = require("../utils/middleware/validatedRequest");
const fs = require("fs");
const path = require("path");

function documentEndpoints(app) {
  if (!app) return;
  app.post(
    "/document/create-folder",
    [validatedRequest, flexUserRoleValid([ROLES.admin, ROLES.manager])],
    async (request, response) => {
      try {
        const { name } = reqBody(request);
        const storagePath = path.join(documentsPath, normalizePath(name));
        if (!isWithin(path.resolve(documentsPath), path.resolve(storagePath)))
          throw new Error("Invalid folder name.");

        if (fs.existsSync(storagePath)) {
          response.status(500).json({
            success: false,
            message: "Folder by that name already exists",
          });
          return;
        }

        fs.mkdirSync(storagePath, { recursive: true });
        response.status(200).json({ success: true, message: null });
      } catch (e) {
        console.error(e);
        response.status(500).json({
          success: false,
          message: `Failed to create folder: ${e.message} `,
        });
      }

View on GitHub (pinned to 526360e320)

Solutions

Use a plain folder name without separators or '..': 'my-folder'.
Ensure the documentsPath setting points to the intended storage root.
Strip path separators in the client before submitting.
Treat this as expected behavior for malicious input — do not relax isWithin.

Example fix

// before
{ name: '/absolute/folder' }
// after
{ name: 'absolute-folder' }

Defensive patterns

Strategy: validation

Validate before calling

function safeFolderName(name) {
  if (typeof name !== 'string' || name.length === 0) return null;
  if (name.includes('..') || name.includes('/') || name.includes('\\') || path.isAbsolute(name)) return null;
  return name;
}

Try / catch

try {
  await createFolder(name);
} catch (e) {
  if (e.message === 'Invalid folder name.') return res.status(400).json({ success: false, message: 'Use a plain folder name without separators' });
  throw e;
}

Prevention

Use plain folder names in the UI.
Strip separators on the client before submit.
Treat the error as expected for malicious input — keep the guard.

When it happens

Trigger: The web UI submitting a folder name containing '../', an absolute path, or an empty string that resolves to the documents root. Same root causes as error 125.

Common situations: A browser extension or custom UI forwarded a path with separators; a copy-paste folder name included a leading slash; the documents storage directory was misconfigured so even legitimate names resolve outside it.

Related errors

AI-assisted analysis of Mintplex-Labs/anything-llm@526360e320 (2026-08-13). Data as JSON: /api/errors/fcdc44c60e4cc84f. Report an issue: GitHub.