headroomlabs-ai/headroom · error · ValueError

Path traversal detected: {path}

Error message

Path traversal detected: {path}

What it means

Error "Path traversal detected: {path}" thrown in headroomlabs-ai/headroom.

Source

Thrown at headroom/proxy/memory_handler.py:1594

        # User-scoped memory directory
        user_dir = self._native_memory_dir / user_id
        user_dir.mkdir(parents=True, exist_ok=True)

        # Normalize path (remove /memories prefix if present)
        if path.startswith("/memories"):
            path = path[len("/memories") :]
        if path.startswith("/"):
            path = path[1:]

        # Resolve and validate
        resolved = (user_dir / path).resolve()

        # Security: ensure path is within user directory
        try:
            resolved.relative_to(user_dir.resolve())
        except ValueError:
            raise ValueError(f"Path traversal detected: {path}") from None

        return resolved

    def _native_view(self, input_data: dict[str, Any], user_id: str) -> str:
        """View directory contents or file contents."""
        path = input_data.get("path", "/memories")
        view_range = input_data.get("view_range")

        resolved = self._resolve_native_path(path, user_id)

        if not resolved.exists():
            return f"The path {path} does not exist. Please provide a valid path."

        if resolved.is_dir():
            # List directory contents
            lines = [
                f"Here're the files and directories up to 2 levels deep in {path}, "
                "excluding hidden items and node_modules:"

View on GitHub (pinned to 322425c43b)

Solutions

1. Do not include '..' or absolute path segments in the requested path
2. Use a path relative to the memory storage root
3. If the path is built from user input, sanitize/normalize it before sending

When it happens

Trigger: Raised when a memory-handler file path resolves outside the allowed storage root, blocking a path traversal attempt.

Common situations: See trigger scenarios.

AI-assisted analysis of headroomlabs-ai/headroom@322425c43b (2026-08-15). Data as JSON: /api/errors/6516960ae9f8cd7e. Report an issue: GitHub.