{"record":{"id":"53ff54a6b21a3ccc","repo":"hiyouga/LlamaFactory","slug":"invalid-or-inaccessible-file-path","errorCode":null,"errorMessage":"Invalid or inaccessible file path.","messagePattern":"Invalid or inaccessible file path\\.","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"src/llamafactory/api/common.py","lineNumber":67,"sourceCode":"        return data.json(exclude_unset=True, ensure_ascii=False)\n\n\ndef check_lfi_path(path: str) -> None:\n    \"\"\"Checks if a given path is vulnerable to LFI. Raises HTTPException if unsafe.\"\"\"\n    if not ALLOW_LOCAL_FILES:\n        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=\"Local file access is disabled.\")\n\n    try:\n        os.makedirs(SAFE_MEDIA_PATH, exist_ok=True)\n        real_path = os.path.realpath(path)\n        safe_path = os.path.realpath(SAFE_MEDIA_PATH)\n\n        if not real_path.startswith(safe_path):\n            raise HTTPException(\n                status_code=status.HTTP_403_FORBIDDEN, detail=\"File access is restricted to the safe media directory.\"\n            )\n    except Exception:\n        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=\"Invalid or inaccessible file path.\")\n\n\ndef check_ssrf_url(url: str) -> None:\n    \"\"\"Checks if a given URL is vulnerable to SSRF. Raises HTTPException if unsafe.\"\"\"\n    try:\n        parsed_url = urlparse(url)\n        if parsed_url.scheme not in [\"http\", \"https\"]:\n            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=\"Only HTTP/HTTPS URLs are allowed.\")\n\n        hostname = parsed_url.hostname\n        if not hostname:\n            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=\"Invalid URL hostname.\")\n\n        ip_info = socket.getaddrinfo(hostname, parsed_url.port)\n        ip_address_str = ip_info[0][4][0]\n        ip = ipaddress.ip_address(ip_address_str)\n\n        if not ip.is_global:","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/hiyouga/LlamaFactory/blob/f28afaf6355af515454dfb16c97d728307c93897/src/llamafactory/api/common.py#L49-L85","documentation":"Raised as HTTP 400 by check_lfi_path's broad except: any exception during makedirs(SAFE_MEDIA_PATH), realpath resolution, or the prefix check converts into this generic 'Invalid or inaccessible file path'. Typical causes: the path does not exist (realpath itself succeeds, but makedirs may fail on permissions), SAFE_MEDIA_PATH cannot be created, or an OS-level error resolving the path.","triggerScenarios":"SAFE_MEDIA_PATH points to a location the server process cannot create/write (permission denied); path is None or contains NUL bytes causing an OS error; exotic filesystem errors during realpath.","commonSituations":"Running the API as an unprivileged user with SAFE_MEDIA_PATH under root-owned storage; read-only container volumes; misconfigured safe path env var pointing at a file instead of a directory.","solutions":["Verify the server process can create and write SAFE_MEDIA_PATH (check permissions/ownership, mount read-only flags).","Point SAFE_MEDIA_PATH at an existing writable directory.","Confirm the requested media path actually exists and is a valid string.","Reproduce with `sudo -u <api user> realpath <path>` on the host to see the underlying OS error."],"exampleFix":"# before: SAFE_MEDIA_PATH=/var/lib/llamafactory/media (root-owned, api runs as app)\n# after\nchown -R app:app /var/lib/llamafactory/media   # or set SAFE_MEDIA_PATH=/home/app/media","handlingStrategy":"validation","validationCode":"import os\nSAFE = os.environ.get(\"SAFE_MEDIA_PATH\", \"/tmp/llamafactory-media\")\nos.makedirs(SAFE, exist_ok=True)  # fails fast here if unwritable\nassert os.access(SAFE, os.R_OK | os.W_OK)","typeGuard":null,"tryCatchPattern":"catch (e) { if (e.status === 400 && e.detail === 'Invalid or inaccessible file path.') { report(`check ${SAFE_MEDIA_PATH} writability and that ${path} exists`); } throw e; }","preventionTips":["Startup script: create and probe-write SAFE_MEDIA_PATH before serving traffic.","Run the API as a user with ownership of the safe directory.","Avoid read-only mounts for the safe media path."],"tags":["security","filesystem","permissions","http-400","lfi"],"backgroundTag":null,"analyzedSha":"f28afaf6355af515454dfb16c97d728307c93897","analyzedAt":"2026-08-14T21:57:28.298Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}