{"record":{"id":"17f901faf6341d31","repo":"Mintplex-Labs/anything-llm","slug":"invalid-path-name","errorCode":null,"errorMessage":"Invalid path name","messagePattern":"Invalid path name","errorType":"validation","errorClass":"Error","httpStatus":500,"severity":"warning","filePath":"server/endpoints/api/document/index.js","lineNumber":941,"sourceCode":"              example: {\n                success: true,\n                message: null\n              }\n            }\n          }\n        }\n      }\n      #swagger.responses[403] = {\n        schema: {\n          \"$ref\": \"#/definitions/InvalidAPIKey\"\n        }\n      }\n      */\n      try {\n        const { name } = reqBody(request);\n        const storagePath = path.join(documentsPath, normalizePath(name));\n        if (!isWithin(path.resolve(documentsPath), path.resolve(storagePath)))\n          throw new Error(\"Invalid path name\");\n\n        if (fs.existsSync(storagePath)) {\n          response.status(500).json({\n            success: false,\n            message: \"Folder by that name already exists\",\n          });\n          return;\n        }\n\n        fs.mkdirSync(storagePath, { recursive: true });\n        response.status(200).json({ success: true, message: null });\n      } catch (e) {\n        console.error(e);\n        response.status(500).json({\n          success: false,\n          message: `Failed to create folder: ${e.message}`,\n        });\n      }","sourceCodeStart":923,"sourceCodeEnd":959,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/526360e320da9d1b36074be5ed64fe76e5bbfbbd/server/endpoints/api/document/index.js#L923-L959","documentation":"Thrown by the API v1 folder-creation endpoint POST /v1/document/create-folder. The folder name is normalized (leading ../ stripped) and joined under documentsPath, then isWithin() checks the resolved path still lives inside documentsPath. If not — path traversal succeeded, the name resolved to the documents root itself (rel === '' returns false), or the name was an absolute path — the guard rejects it. This is a security boundary preventing directory escape.","triggerScenarios":"Posting { name: '../' }, { name: '../../etc/passwd' }, an absolute path like { name: '/tmp' }, or an empty/root-equivalent name. Also when the name contains backslash traversal on Windows that normalizePath does not fully collapse.","commonSituations":"A client sent a relative path expecting subfolder creation; a fuzzing/security scan hit the endpoint; the UI forwarded an unsanitized user-typed path.","solutions":["Send a simple leaf folder name with no path separators: { name: 'new-folder' }.","For nested folders send forward-slash relative paths that stay inside documents (e.g. 'parent/child') and verify your normalizePath version handles them.","Never send absolute paths or '..' segments.","Confirm the documentsPath system setting is correctly configured."],"exampleFix":"// before\nfetch('/api/v1/document/create-folder', { method: 'POST', body: JSON.stringify({ name: '../outside' }) });\n// after\nfetch('/api/v1/document/create-folder', { method: 'POST', body: JSON.stringify({ name: 'reports-2024' }) });","handlingStrategy":"validation","validationCode":"function safeFolderName(name) {\n  if (typeof name !== 'string' || name.length === 0) return null;\n  if (name.includes('..') || name.includes('/') || name.includes('\\\\') || path.isAbsolute(name)) return null;\n  return name;\n}\nconst safe = safeFolderName(req.body.name);\nif (!safe) return res.status(400).json({ success: false, message: 'Invalid folder name' });","typeGuard":null,"tryCatchPattern":"try {\n  await createFolder(name);\n} catch (e) {\n  if (e.message === 'Invalid path name') return res.status(400).json({ success: false, message: 'Folder name must be a relative name without separators' });\n  throw e;\n}","preventionTips":["Send only leaf folder names with no path separators.","Validate on the client before posting.","Never disable isWithin — it is the path-traversal guard."],"tags":["filesystem","path-traversal","security","documents","validation"],"backgroundTag":null,"analyzedSha":"526360e320da9d1b36074be5ed64fe76e5bbfbbd","analyzedAt":"2026-08-13T01:45:47.170Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}