{"record":{"id":"3e36dbe5981cb6fd","repo":"OrchardCMS/OrchardCore","slug":"cannot-resolve-physical-path-with-the-path-path","errorCode":null,"errorMessage":"Cannot resolve physical path with the path '{path}'.","messagePattern":"Cannot resolve physical path with the path '(.+?)'\\.","errorType":"exception","errorClass":"FileStoreException","httpStatus":null,"severity":"error","filePath":"src/OrchardCore/OrchardCore.FileStorage.FileSystem/FileSystemStore.cs","lineNumber":444,"sourceCode":"\n            var physicalPath = string.IsNullOrEmpty(path) ? _fileSystemPath : Path.Combine(_fileSystemPath, path);\n\n            // Verify that the resulting path is inside the root file system path.\n            var pathIsAllowed = Path.GetFullPath(physicalPath).StartsWith(_fileSystemPath, StringComparison.OrdinalIgnoreCase);\n            if (!pathIsAllowed)\n            {\n                throw new FileStoreException($\"The path '{path}' resolves to a physical path outside the file system store root.\");\n            }\n\n            return physicalPath;\n        }\n        catch (FileStoreException)\n        {\n            throw;\n        }\n        catch (Exception ex)\n        {\n            throw new FileStoreException($\"Cannot resolve physical path with the path '{path}'.\", ex);\n        }\n    }\n}\n","sourceCodeStart":426,"sourceCodeEnd":448,"githubUrl":"https://github.com/OrchardCMS/OrchardCore/blob/4306c0717fe573f6fca1b4955909ddab6a192807/src/OrchardCore/OrchardCore.FileStorage.FileSystem/FileSystemStore.cs#L426-L448","documentation":"Generic catch-all in FileSystemStore.GetPhysicalPath: any non-FileStoreException thrown while combining/canonicalizing the path (e.g. Path.Combine or Path.GetFullPath failing on invalid characters, NotSupportedException, security exceptions) is re-wrapped as FileStoreException 'Cannot resolve physical path'. InnerException retains the cause.","triggerScenarios":"Calling any IFileStore operation with a path containing invalid filesystem characters (e.g. '<', '|', ':' in a segment on Windows), embedded NULs, or an empty/whitespace-only segment that breaks Path.GetFullPath.","commonSituations":"Filenames derived from user content (content item titles) containing reserved characters; paths built from media URLs with un-encoded special characters; Linux-hosted content with ':' in names later served on Windows; corrupted stored paths from an earlier bug.","solutions":["Read the InnerException to see which path API failed and why.","Sanitize the path before use: remove/rename invalid characters per the target OS (use a whitelist like [A-Za-z0-9._-]).","Check the stored path data for corruption and repair the records producing bad paths.","Catch FileStoreException around IFileStore calls and return a user-facing 'invalid path' message instead of crashing."],"exampleFix":"// before\nvar path = $\"media/{contentItem.DisplayText}.pdf\";\nawait fileStore.CreateFileFromStreamAsync(path, stream);\n// after\nvar invalid = Path.GetInvalidFileNameChars();\nvar safeName = string.Join(\"\", contentItem.DisplayText.Split(invalid));\nvar path = $\"media/{safeName}.pdf\";\nawait fileStore.CreateFileFromStreamAsync(path, stream);","handlingStrategy":"validation","validationCode":"if (path.IndexOfAny(Path.GetInvalidPathChars()) >= 0 || string.IsNullOrWhiteSpace(path))\n{\n    throw new ArgumentException($\"Path '{path}' contains invalid characters.\");\n}","typeGuard":"static bool IsValidStorePath(string path) =>\n    !string.IsNullOrWhiteSpace(path)\n    && path.IndexOfAny(Path.GetInvalidPathChars()) < 0\n    && !path.Contains('\\0');","tryCatchPattern":"try\n{\n    var info = await fileStore.GetFileInfoAsync(path);\n}\ncatch (FileStoreException ex) when (ex.Message.StartsWith(\"Cannot resolve physical path\"))\n{\n    logger.LogError(ex.InnerException, \"Unresolvable store path '{Path}'\", path);\n    throw new ApplicationException(\"The file path is invalid for this filesystem.\", ex);\n}","preventionTips":["Sanitize names derived from content titles with a character whitelist before building paths.","Be aware of OS differences: characters legal on Linux may fail on Windows and vice versa.","Validate stored path data after migrations or imports.","Read InnerException to distinguish character-set problems from permission problems."],"tags":["file-storage","invalid-path","path-resolution"],"backgroundTag":"invalid-argument-format","analyzedSha":"4306c0717fe573f6fca1b4955909ddab6a192807","analyzedAt":"2026-09-13T17:41:05.024Z","contentChangedAt":"2026-09-13T17:41:05.024Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}