{"record":{"id":"625dc98aa234e3aa","repo":"kestra-io/kestra","slug":"the-path-is-not-authorized-path-must-be-allowe","errorCode":null,"errorMessage":"The path {} is not authorized. Path must be allowed either globally inside the Kestra configuration using the `kestra.local-files.allowed-paths` property.","messagePattern":"The path (.+?) is not authorized\\. Path must be allowed either globally inside the Kestra configuration using the `kestra\\.local-files\\.allowed-paths` property\\.","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/io/kestra/core/runners/LocalPathFactory.java","lineNumber":143,"sourceCode":"            }\n\n            return path;\n        }\n    }\n\n    static class DefaultLocalPath extends AbstractLocalPath {\n        private final List<Path> globalAllowedPaths;\n\n        DefaultLocalPath(List<Path> globalAllowedPaths) {\n            this.globalAllowedPaths = globalAllowedPaths;\n        }\n\n        @Override\n        protected Path checkPath(URI uri) throws IOException {\n            Path path = Path.of(uri).toRealPath(); // toRealPath() will protect about path traversal issues\n            // we only allow globally allowed as we don't have a run context to get the working directory nor the plugin configuration\n            if (globalAllowedPaths.stream().noneMatch(path::startsWith)) {\n                throw new SecurityException(\n                    \"The path \" + path + \" is not authorized. \" +\n                        \"Path must be allowed either globally inside the Kestra configuration using the `\" + LocalPath.ALLOWED_PATHS_CONFIG + \"` property.\"\n                );\n            }\n\n            return path;\n        }\n    }\n}\n","sourceCodeStart":125,"sourceCodeEnd":153,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/core/src/main/java/io/kestra/core/runners/LocalPathFactory.java#L125-L153","documentation":"Thrown by `DefaultLocalPath.checkPath` — the variant of `LocalPath` created WITHOUT a `RunContext` (`createLocalPath()`). Because there is no working directory or plugin config to consult, the ONLY allowed locations are the globally-configured `kestra.local-files.allowed-paths`. If the resolved real path is not under one of those, a `SecurityException` is thrown.","triggerScenarios":"Code that calls `localPathFactory.createLocalPath()` (no RunContext) and then resolves a `file://` URI pointing outside the globally-allowed paths. Typically internal/utility callers that run outside a task's execution context (e.g. bootstrap, CLI, or a service that has no working dir).","commonSituations":"A plugin or service resolving local files before a RunContext exists; misconfigured `kestra.local-files.allowed-paths` on a fresh deployment; an absolute path that worked with the RunContext variant but fails with the default variant because no global allow-list is set.","solutions":["Prefer `createLocalPath(runContext)` when a RunContext is available — it also permits the working directory and plugin paths.","Configure `kestra.local-files.allowed-paths` to include the required directories.","Move the file access into task execution so a RunContext is present."],"exampleFix":"// before — no RunContext, only global allow-list applies\nLocalPath lp = localPathFactory.createLocalPath();\nlp.get(URI.create(\"file:///data/input.csv\")); // throws if /data not allowed\n\n// after — use the RunContext-aware variant\nLocalPath lp = localPathFactory.createLocalPath(runContext);\nlp.get(URI.create(\"file:///data/input.csv\")); // ok if /data is plugin-allowed or in working dir","handlingStrategy":"validation","validationCode":"// Prefer the RunContext-aware variant; only use createLocalPath() when unavoidable\nLocalPath lp = (runContext != null)\n    ? localPathFactory.createLocalPath(runContext)\n    : localPathFactory.createLocalPath();\n// for the no-context variant, ensure the target is under a globally allowed path","typeGuard":null,"tryCatchPattern":"try {\n    return lp.get(uri);\n} catch (SecurityException e) {\n    throw new SecurityException(\"Path not in global allowed-paths ('\" + LocalPath.ALLOWED_PATHS_CONFIG + \"'): \" + uri, e);\n}","preventionTips":["Always pass a RunContext to createLocalPath when available.","Maintain the global `kestra.local-files.allowed-paths` list in config-as-code.","Avoid resolving host files outside task execution."],"tags":["security","local-files","path-traversal","authorization","runcontext"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}