{"record":{"id":"086fcaac3017901d","repo":"coollabsio/coolify","slug":"invalid-fieldname-path-traversal-detected","errorCode":null,"errorMessage":"Invalid {$fieldName}: path traversal detected.","messagePattern":"Invalid (.+?): path traversal detected\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"app/Jobs/ApplicationDeploymentJob.php","lineNumber":4679,"sourceCode":"        $composeFile['services'] = $services;\n        $existingSecrets = data_get($composeFile, 'secrets', []);\n        if ($existingSecrets instanceof Collection) {\n            $existingSecrets = $existingSecrets->toArray();\n        }\n        $composeFile['secrets'] = array_replace($existingSecrets, $secrets);\n\n        $this->application_deployment_queue->addLogEntry('Added build secrets configuration to docker-compose file (using environment variables).');\n\n        return $composeFile;\n    }\n\n    private function validatePathField(string $value, string $fieldName): string\n    {\n        if (! preg_match(ValidationPatterns::FILE_PATH_PATTERN, $value)) {\n            throw new \\RuntimeException(\"Invalid {$fieldName}: contains forbidden characters.\");\n        }\n        if (str_contains($value, '..')) {\n            throw new \\RuntimeException(\"Invalid {$fieldName}: path traversal detected.\");\n        }\n\n        return $value;\n    }\n\n    private function validateShellSafeCommand(string $value, string $fieldName): string\n    {\n        if (! preg_match(ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN, $value)) {\n            throw new \\RuntimeException(\"Invalid {$fieldName}: contains forbidden shell characters.\");\n        }\n\n        return $value;\n    }\n\n    private function validateContainerName(string $value): string\n    {\n        if (! preg_match(ValidationPatterns::CONTAINER_NAME_PATTERN, $value)) {\n            throw new \\RuntimeException('Invalid container name: contains forbidden characters.');","sourceCodeStart":4661,"sourceCodeEnd":4697,"githubUrl":"https://github.com/coollabsio/coolify/blob/70b9acc42467278373e00de77abb40684e25b395/app/Jobs/ApplicationDeploymentJob.php#L4661-L4697","documentation":"The second check in validatePathField(): the value passed FILE_PATH_PATTERN but str_contains($value, '..') is true, so the deployment aborts with 'path traversal detected'. Any '..' sequence — even a legitimate-looking 'my..app' directory component — is rejected to prevent escaping the intended directory via a/../../etc-style paths.","triggerScenarios":"A path field contains '..' anywhere: '../secrets', '/app/../lib', or a directory whose real name includes '..'; deployed paths are later joined with server-side directories, so traversal would escape the sandbox.","commonSituations":"Users trying to reference files outside the app directory ('../../shared/env'); paths generated by templating that leave literal '..' behind; directory names that coincidentally contain double dots.","solutions":["Remove all '..' segments and write the resolved absolute path instead (e.g. '/shared/env' instead of '/app/../shared/env').","Move the referenced file inside the allowed directory tree and point at it directly.","Rename directories whose names literally contain '..'."],"exampleFix":"# before: traversal segment\ndockerfileLocation: '/app/../shared/Dockerfile'\n\n# after: absolute path without '..'\ndockerfileLocation: '/shared/Dockerfile'","handlingStrategy":"validation","validationCode":"// Block traversal at save time\nif (str_contains($value, '..')) {\n    throw new \\InvalidArgumentException('Path must not contain \"..\" segments.');\n}\nif (! preg_match(\\App\\Support\\ValidationPatterns::FILE_PATH_PATTERN, $value)) {\n    throw new \\InvalidArgumentException('Invalid path characters.');\n}","typeGuard":"function isTraversalFreePath(string $value): bool\n{\n    return ! str_contains($value, '..');\n}","tryCatchPattern":null,"preventionTips":["Resolve relative segments server-side (realpath-style normalization) instead of accepting '..' from users.","Reject any '..' occurrence — even inside a directory name — to keep the rule simple and safe.","Reference files outside the tree by absolute path, never via parent segments."],"tags":["docker","deployment","path-traversal","security","validation"],"backgroundTag":"path-traversal-blocked","analyzedSha":"70b9acc42467278373e00de77abb40684e25b395","analyzedAt":"2026-08-17T01:41:01.313Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}