alibaba/nacos · critical · SecurityException

Path traversal detected: {path}

Error message

Path traversal detected: {path}

What it means

SkillUtils.validatePathSafety throws SecurityException when a resource path contains the '..' sequence. This is a path-traversal guard that prevents ZIP-slip attacks during skill packaging and extraction — a malicious or malformed entry name could escape the target directory.

Source

Thrown at api/src/main/java/com/alibaba/nacos/api/ai/model/skills/SkillUtils.java:173

        } else {
            entryPath = skillName + "/" + resource.getName();
        }
        validatePathSafety(entryPath);
        return entryPath;
    }
    
    /**
     * Validate that a path does not contain path traversal sequences or absolute path indicators.
     *
     * @param path the path to validate
     * @throws SecurityException if path contains unsafe sequences
     */
    public static void validatePathSafety(String path) {
        if (path == null) {
            return;
        }
        if (path.contains(PATH_TRAVERSAL_SEQUENCE)) {
            throw new SecurityException("Path traversal detected: " + path);
        }
        if (path.startsWith("/") || path.startsWith("\\")) {
            throw new SecurityException("Absolute path not allowed: " + path);
        }
    }
    
    /**
     * Validate that a resolved path stays within the expected base directory.
     *
     * @param baseDir the base directory that must contain the target
     * @param target  the resolved target path
     * @throws SecurityException if target escapes baseDir
     */
    public static void validatePathContainment(Path baseDir, Path target) {
        if (!target.normalize().startsWith(baseDir.normalize())) {
            throw new SecurityException(
                "Path escapes target directory: " + target + " is outside " + baseDir);
        }

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Sanitize or reject resource paths containing '..' before adding them to a Skill.
2. When extracting ZIPs, canonicalize each entry path and verify it starts with the base directory.
3. Reject any ZIP entry whose name contains '..' at upload/validation time.
4. Educate users that '..' in resource paths is not permitted in skill packaging.

Example fix

// before
skill.getResource().add(new SkillResource("../../secret.txt", data));
SkillUtils.validatePathSafety("../../secret.txt"); // SecurityException

// after -- reject at upload
for (SkillResource r : skill.getResource()) {
    SkillUtils.validatePathSafety(r.getPath()); // fails fast
    // or sanitize: r.setPath(r.getPath().replace("..", ""));
}

// For ZIP extraction:
Path resolved = baseDir.resolve(entryName).normalize();
if (!resolved.startsWith(baseDir)) {
    throw new SecurityException("ZIP slip: " + entryName);
}

// Pre-check before adding resources or extracting ZIP entries
public static void assertPathSafe(String path) {
    if (path != null && path.contains("..")) {
        throw new SecurityException("Rejected path with traversal: " + path);
    }
}

// For ZIP extraction:
Path resolved = baseDir.resolve(entryName).normalize();
if (!resolved.startsWith(baseDir)) {
    throw new SecurityException("Entry escapes base dir: " + entryName);
}

public static boolean isPathSafe(String path) {
    if (path == null) return true;
    if (path.contains("..")) return false;
    if (path.startsWith("/") || path.startsWith("\\")) return false;
    return true;
}

try {
    SkillUtils.validatePathSafety(resourcePath);
} catch (SecurityException e) {
    logger.error("Rejected unsafe path: {}", resourcePath);
    // skip this entry or abort the operation
    throw new ResponseStatusException(HttpStatus.BAD_REQUEST,
        "Resource path contains forbidden traversal sequence");
}

When it happens

Trigger: A Skill resource path contains '..', e.g. '../../etc/passwd' or 'subdir/../other'. Also triggered during ZIP extraction if a ZipEntry name contains traversal sequences. A user-uploaded skill ZIP includes entries with relative-parent references.

Common situations: Processing an untrusted or user-uploaded skill ZIP. A resource path was constructed by concatenating user input without sanitization. A legitimate path that contains '..' as part of a directory name (e.g. 'my..app/resource').

Related errors

• PARAMETER_VALIDATE_ERROR
• SERVER_ERROR
• PARAMETER_MISSING
• PARAMETER_MISSING
• PARAMETER_VALIDATE_ERROR

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/1c9eccc1a18b0aff. Report an issue: GitHub.