Mintplex-Labs/anything-llm · warning · Error
Invalid path name
Error message
Invalid path name
What it means
Thrown by the API v1 folder-creation endpoint POST /v1/document/create-folder. The folder name is normalized (leading ../ stripped) and joined under documentsPath, then isWithin() checks the resolved path still lives inside documentsPath. If not — path traversal succeeded, the name resolved to the documents root itself (rel === '' returns false), or the name was an absolute path — the guard rejects it. This is a security boundary preventing directory escape.
Source
Thrown at server/endpoints/api/document/index.js:941
example: {
success: true,
message: null
}
}
}
}
}
#swagger.responses[403] = {
schema: {
"$ref": "#/definitions/InvalidAPIKey"
}
}
*/
try {
const { name } = reqBody(request);
const storagePath = path.join(documentsPath, normalizePath(name));
if (!isWithin(path.resolve(documentsPath), path.resolve(storagePath)))
throw new Error("Invalid path name");
if (fs.existsSync(storagePath)) {
response.status(500).json({
success: false,
message: "Folder by that name already exists",
});
return;
}
fs.mkdirSync(storagePath, { recursive: true });
response.status(200).json({ success: true, message: null });
} catch (e) {
console.error(e);
response.status(500).json({
success: false,
message: `Failed to create folder: ${e.message}`,
});
}View on GitHub (pinned to 526360e320)
Solutions
- Send a simple leaf folder name with no path separators: { name: 'new-folder' }.
- For nested folders send forward-slash relative paths that stay inside documents (e.g. 'parent/child') and verify your normalizePath version handles them.
- Never send absolute paths or '..' segments.
- Confirm the documentsPath system setting is correctly configured.
Example fix
// before
fetch('/api/v1/document/create-folder', { method: 'POST', body: JSON.stringify({ name: '../outside' }) });
// after
fetch('/api/v1/document/create-folder', { method: 'POST', body: JSON.stringify({ name: 'reports-2024' }) }); Defensive patterns
Strategy: validation
Validate before calling
function safeFolderName(name) {
if (typeof name !== 'string' || name.length === 0) return null;
if (name.includes('..') || name.includes('/') || name.includes('\\') || path.isAbsolute(name)) return null;
return name;
}
const safe = safeFolderName(req.body.name);
if (!safe) return res.status(400).json({ success: false, message: 'Invalid folder name' }); Try / catch
try {
await createFolder(name);
} catch (e) {
if (e.message === 'Invalid path name') return res.status(400).json({ success: false, message: 'Folder name must be a relative name without separators' });
throw e;
} Prevention
- Send only leaf folder names with no path separators.
- Validate on the client before posting.
- Never disable isWithin — it is the path-traversal guard.
When it happens
Trigger: Posting { name: '../' }, { name: '../../etc/passwd' }, an absolute path like { name: '/tmp' }, or an empty/root-equivalent name. Also when the name contains backslash traversal on Windows that normalizePath does not fully collapse.
Common situations: A client sent a relative path expecting subfolder creation; a fuzzing/security scan hit the endpoint; the UI forwarded an unsanitized user-typed path.
Related errors
AI-assisted analysis of Mintplex-Labs/anything-llm@526360e320 (2026-08-13).
Data as JSON: /api/errors/17f901faf6341d31.
Report an issue: GitHub.