gotify/server · warning

invalid file

Error message

invalid file

What it means

onlyImageFS wraps the static file system serving application images and rejects any request whose file extension is not a valid application image extension, returning 'invalid file' to block serving of non-image or path-manipulated files.

Source

Thrown at router/router.go:321

			Str("method", c.Request.Method).
			Str("path", path)

		if errs := c.Errors.ByType(gin.ErrorTypePrivate).String(); errs != "" {
			evt.Str("errors", strings.TrimSpace(errs))
		}

		evt.Msg("HTTP")
	}
}

type onlyImageFS struct {
	inner http.FileSystem
}

func (fs *onlyImageFS) Open(name string) (http.File, error) {
	ext := filepath.Ext(name)
	if !api.ValidApplicationImageExt(ext) {
		return nil, fmt.Errorf("invalid file")
	}
	return fs.inner.Open(name)
}

View on GitHub (pinned to 14bfc25627)

Solutions

1. Request only files with valid image extensions (check api.ValidApplicationImageExt for the allowed set)
2. Use the correct filename returned by the image upload API
3. Do not attempt to serve arbitrary files through the image endpoint

name := "photo.png"
if !api.ValidApplicationImageExt(filepath.Ext(name)) {
    log.Printf("%s is not a valid image name", name)
}

func validImageName(name string) bool {
    return api.ValidApplicationImageExt(filepath.Ext(name))
}

resp, err := http.Get(imageURL)
if err != nil || resp.StatusCode != http.StatusOK {
    body, _ := io.ReadAll(resp.Body)
    if strings.Contains(string(body), "invalid file") {
        log.Printf("bad image path %s", imageURL)
    }
}

When it happens

Trigger: An HTTP request to the image route for a filename with an extension not in the allowed image set (e.g. .php, .html, .txt, or no extension).

Common situations: Probing for path traversal or sensitive files (../../etc/passwd), or clients referencing an uploaded image by the wrong filename/extension.

Related errors

• basic auth required
• invalid credentials
• no client auth provided
• you are not allowed to access this api
• you are not allowed to create an admin user

AI-assisted analysis of gotify/server@14bfc25627 (2026-09-05). Data as JSON: /api/errors/6404a786d6316e5a. Report an issue: GitHub.