OrchardCMS/OrchardCore · error · InvalidOperationException

This file extension is not allowed

Error message

This file extension is not allowed: {0}

What it means

The uploaded file's extension is checked against MediaOptions.AllowedFileExtensions; if not allowed, the extension must be present in RestrictedFileExtensions AND the user must hold UploadRestrictedMedia permission. Otherwise it throws 'This file extension is not allowed: {0}'.

Solutions

1. Add the extension to Settings > Media > Allowed file extensions
2. Or add it to Restricted file extensions and grant the role 'Upload restricted media' permission
3. Rename the file to an allowed extension if the content type genuinely differs

var ext = Path.GetExtension(media.name); var allowed = mediaOptions.AllowedFileExtensions.Contains(ext) || (mediaOptions.RestrictedFileExtensions.Contains(ext) && canUploadRestricted);

try { await client.NewMediaObjectAsync(blogId, user, pass, media); } catch (InvalidOperationException ex) when (ex.Message.StartsWith("This file extension is not allowed")) { ConvertFileToAllowedExtension(media); }

When it happens

Trigger: Uploading a file whose extension (case as derived from the path) is not in the allowed list and is not an allowed restricted upload by a permitted user; e.g. .exe, .svg when not configured.

Common situations: Strict default media settings blocking formats like .svg or .webp; clients uploading file types not added in Media settings; case/leading-dot variations in extension.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• The media path is invalid.
• The file extension should start with a dot.
• The file ' ' was rejected.
• Not authorized to upload media.
• The 'Default' tenant can't be removed.

AI-assisted analysis of OrchardCMS/OrchardCore@4306c0717f (2026-09-13). Data as JSON: /api/errors/923efd83d52f8c7b. Report an issue: GitHub.

Appendix: source

Thrown at src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs:191

        var fileName = pathSegments[^1];
        var directoryName = string.Join('/', pathSegments[..^1]);
        var filePath = _mediaFileStore.Combine(directoryName, fileName);

        if (!await _authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMedia)
            || !await _authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMediaFolder, (object)(directoryName ?? string.Empty)))
        {
            throw new InvalidOperationException(S["Not authorized to upload media."].Value);
        }

        var extension = Path.GetExtension(filePath);
        var canUploadRestrictedMedia = await _authorizationService.AuthorizeAsync(
            user,
            MediaPermissions.UploadRestrictedMedia);
        if (!_mediaOptions.AllowedFileExtensions.Contains(extension)
            && (!canUploadRestrictedMedia
                || !_mediaOptions.RestrictedFileExtensions.Contains(extension)))
        {
            throw new InvalidOperationException(S["This file extension is not allowed: {0}", extension].Value);
        }

        Stream stream = null;
        try
        {
            stream = new MemoryStream(bits);
            filePath = await _mediaFileStore.CreateFileFromStreamAsync(
                _fileCreationService,
                filePath,
                stream,
                contentType: file.Optional<string>("type"));
        }
        finally
        {
            stream?.Dispose();
        }

        var publicUrl = _mediaFileStore.MapPathToPublicUrl(filePath);

View on GitHub (pinned to 4306c0717f)