{"record":{"id":"de002cfd9ede0779","repo":"PowerShell/PowerShell","slug":"access-to-the-path-0-is-denied","errorCode":null,"errorMessage":"Access to the path '{0}' is denied.","messagePattern":"Access to the path '(.+?)' is denied\\.","errorType":"exception","errorClass":"UnauthorizedAccessException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.PowerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs","lineNumber":1228,"sourceCode":"                        break;\n                    default:\n                        SetRequestContent(request, (string)LanguagePrimitives.ConvertTo(content, typeof(string), CultureInfo.InvariantCulture));\n                        break;\n                }\n            }\n            else if (InFile is not null)\n            {\n                // Copy InFile data\n                try\n                {\n                    // Open the input file\n                    SetRequestContent(request, new FileStream(InFile, FileMode.Open, FileAccess.Read, FileShare.Read));\n                }\n                catch (UnauthorizedAccessException)\n                {\n                    string msg = string.Format(CultureInfo.InvariantCulture, WebCmdletStrings.AccessDenied, _originalFilePath);\n\n                    throw new UnauthorizedAccessException(msg);\n                }\n            }\n\n            // For other methods like Put where empty content has meaning, we need to fill in the content\n            if (request.Content is null)\n            {\n                // If this is a Get request and there is no content, then don't fill in the content as empty content gets rejected by some web services per RFC7230\n                if (request.Method == HttpMethod.Get && ContentType is null)\n                {\n                    return;\n                }\n\n                request.Content = new StringContent(string.Empty);\n                request.Content.Headers.Clear();\n            }\n\n            foreach (KeyValuePair<string, string> entry in WebSession.ContentHeaders)\n            {","sourceCodeStart":1210,"sourceCodeEnd":1246,"githubUrl":"https://github.com/PowerShell/PowerShell/blob/3ff3c711bf54a18f8440f3c5190c3ac91cdc5852/src/Microsoft.PowerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs#L1210-L1246","documentation":"Thrown by Invoke-WebRequest/Invoke-RestMethod when -InFile points to a file that cannot be opened for read due to UnauthorizedAccessException. The original exception is caught and re-thrown with a formatted 'access denied' message referencing the _originalFilePath.","triggerScenarios":"Using -InFile with a path the current identity cannot read (locked, ACL-restricted, or held exclusively by another process), or a path that resolves outside permitted access.","commonSituations":"File held open by another process with an exclusive lock; NTFS ACL denying the service account read access; running under a restricted AppLocker/CI policy; InFile path is a directory or protected system file.","solutions":["Check the file ACL and grant the invoking account read access (icacls / icacls grant)","Close the process holding an exclusive lock on the file, or copy the file to a temp location you own","Verify the path resolves to a real, readable file with Test-Path / Get-Item before calling"],"exampleFix":"# before\nInvoke-WebRequest -Uri $u -Method Put -InFile 'C:\\protected\\data.bin'\n\n# after\nCopy-Item 'C:\\protected\\data.bin' \"$env:TEMP\\data.bin\"\nInvoke-WebRequest -Uri $u -Method Put -InFile \"$env:TEMP\\data.bin\"","handlingStrategy":"validation","validationCode":"if (-not (Test-Path $InFile) -or -not (Get-Item $InFile).CanRead) { throw \"InFile $InFile not readable by current identity.\" }","typeGuard":"null","tryCatchPattern":"try { Invoke-WebRequest -InFile $InFile @params } catch [UnauthorizedAccessException] { Write-Error \"Access denied to $InFile; check ACL/locks.\" }","preventionTips":["Verify read ACL and that no process holds an exclusive lock on -InFile","Copy the source file to a temp location you own before uploading"],"tags":["invoke-webrequest","in-file","access-denied","file-io"],"backgroundTag":null,"analyzedSha":"3ff3c711bf54a18f8440f3c5190c3ac91cdc5852","analyzedAt":"2026-08-13T10:39:10.759Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}