coollabsio/coolify · error · RuntimeException

Invalid {$fieldName}: path traversal detected.

Error message

Invalid {$fieldName}: path traversal detected.

What it means

The second check in validatePathField(): the value passed FILE_PATH_PATTERN but str_contains($value, '..') is true, so the deployment aborts with 'path traversal detected'. Any '..' sequence — even a legitimate-looking 'my..app' directory component — is rejected to prevent escaping the intended directory via a/../../etc-style paths.

Source

Thrown at app/Jobs/ApplicationDeploymentJob.php:4679

        $composeFile['services'] = $services;
        $existingSecrets = data_get($composeFile, 'secrets', []);
        if ($existingSecrets instanceof Collection) {
            $existingSecrets = $existingSecrets->toArray();
        }
        $composeFile['secrets'] = array_replace($existingSecrets, $secrets);

        $this->application_deployment_queue->addLogEntry('Added build secrets configuration to docker-compose file (using environment variables).');

        return $composeFile;
    }

    private function validatePathField(string $value, string $fieldName): string
    {
        if (! preg_match(ValidationPatterns::FILE_PATH_PATTERN, $value)) {
            throw new \RuntimeException("Invalid {$fieldName}: contains forbidden characters.");
        }
        if (str_contains($value, '..')) {
            throw new \RuntimeException("Invalid {$fieldName}: path traversal detected.");
        }

        return $value;
    }

    private function validateShellSafeCommand(string $value, string $fieldName): string
    {
        if (! preg_match(ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN, $value)) {
            throw new \RuntimeException("Invalid {$fieldName}: contains forbidden shell characters.");
        }

        return $value;
    }

    private function validateContainerName(string $value): string
    {
        if (! preg_match(ValidationPatterns::CONTAINER_NAME_PATTERN, $value)) {
            throw new \RuntimeException('Invalid container name: contains forbidden characters.');

View on GitHub (pinned to 70b9acc424)

Solutions

1. Remove all '..' segments and write the resolved absolute path instead (e.g. '/shared/env' instead of '/app/../shared/env').
2. Move the referenced file inside the allowed directory tree and point at it directly.
3. Rename directories whose names literally contain '..'.

Example fix

# before: traversal segment
dockerfileLocation: '/app/../shared/Dockerfile'

# after: absolute path without '..'
dockerfileLocation: '/shared/Dockerfile'

// Block traversal at save time
if (str_contains($value, '..')) {
    throw new \InvalidArgumentException('Path must not contain ".." segments.');
}
if (! preg_match(\App\Support\ValidationPatterns::FILE_PATH_PATTERN, $value)) {
    throw new \InvalidArgumentException('Invalid path characters.');
}

function isTraversalFreePath(string $value): bool
{
    return ! str_contains($value, '..');
}

When it happens

Trigger: A path field contains '..' anywhere: '../secrets', '/app/../lib', or a directory whose real name includes '..'; deployed paths are later joined with server-side directories, so traversal would escape the sandbox.

Common situations: Users trying to reference files outside the app directory ('../../shared/env'); paths generated by templating that leave literal '..' behind; directory names that coincidentally contain double dots.

Related errors

• Invalid {$fieldName}: contains forbidden shell characters.
• Invalid dockerfile_target_build: contains forbidden characte
• Invalid {$fieldName}: contains forbidden characters.
• Invalid container name: contains forbidden characters.
• Pre-deployment command: Could not find a valid container. Is

AI-assisted analysis of coollabsio/coolify@70b9acc424 (2026-08-17). Data as JSON: /api/errors/086fcaac3017901d. Report an issue: GitHub.