hiyouga/LlamaFactory · error · HTTPException

Invalid or inaccessible file path.

Error message

Invalid or inaccessible file path.

What it means

Raised as HTTP 400 by check_lfi_path's broad except: any exception during makedirs(SAFE_MEDIA_PATH), realpath resolution, or the prefix check converts into this generic 'Invalid or inaccessible file path'. Typical causes: the path does not exist (realpath itself succeeds, but makedirs may fail on permissions), SAFE_MEDIA_PATH cannot be created, or an OS-level error resolving the path.

Source

Thrown at src/llamafactory/api/common.py:67

        return data.json(exclude_unset=True, ensure_ascii=False)


def check_lfi_path(path: str) -> None:
    """Checks if a given path is vulnerable to LFI. Raises HTTPException if unsafe."""
    if not ALLOW_LOCAL_FILES:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Local file access is disabled.")

    try:
        os.makedirs(SAFE_MEDIA_PATH, exist_ok=True)
        real_path = os.path.realpath(path)
        safe_path = os.path.realpath(SAFE_MEDIA_PATH)

        if not real_path.startswith(safe_path):
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN, detail="File access is restricted to the safe media directory."
            )
    except Exception:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid or inaccessible file path.")


def check_ssrf_url(url: str) -> None:
    """Checks if a given URL is vulnerable to SSRF. Raises HTTPException if unsafe."""
    try:
        parsed_url = urlparse(url)
        if parsed_url.scheme not in ["http", "https"]:
            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Only HTTP/HTTPS URLs are allowed.")

        hostname = parsed_url.hostname
        if not hostname:
            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid URL hostname.")

        ip_info = socket.getaddrinfo(hostname, parsed_url.port)
        ip_address_str = ip_info[0][4][0]
        ip = ipaddress.ip_address(ip_address_str)

        if not ip.is_global:

View on GitHub (pinned to f28afaf635)

Solutions

1. Verify the server process can create and write SAFE_MEDIA_PATH (check permissions/ownership, mount read-only flags).
2. Point SAFE_MEDIA_PATH at an existing writable directory.
3. Confirm the requested media path actually exists and is a valid string.
4. Reproduce with `sudo -u <api user> realpath <path>` on the host to see the underlying OS error.

Example fix

# before: SAFE_MEDIA_PATH=/var/lib/llamafactory/media (root-owned, api runs as app)
# after
chown -R app:app /var/lib/llamafactory/media   # or set SAFE_MEDIA_PATH=/home/app/media

import os
SAFE = os.environ.get("SAFE_MEDIA_PATH", "/tmp/llamafactory-media")
os.makedirs(SAFE, exist_ok=True)  # fails fast here if unwritable
assert os.access(SAFE, os.R_OK | os.W_OK)

catch (e) { if (e.status === 400 && e.detail === 'Invalid or inaccessible file path.') { report(`check ${SAFE_MEDIA_PATH} writability and that ${path} exists`); } throw e; }

When it happens

Trigger: SAFE_MEDIA_PATH points to a location the server process cannot create/write (permission denied); path is None or contains NUL bytes causing an OS error; exotic filesystem errors during realpath.

Common situations: Running the API as an unprivileged user with SAFE_MEDIA_PATH under root-owned storage; read-only container volumes; misconfigured safe path env var pointing at a file instead of a directory.

Related errors

• Local file access is disabled.
• File access is restricted to the safe media directory.
• Only HTTP/HTTPS URLs are allowed.
• Invalid URL hostname.
• Could not resolve hostname: {parsed_url.hostname}

AI-assisted analysis of hiyouga/LlamaFactory@f28afaf635 (2026-08-14). Data as JSON: /api/errors/53ff54a6b21a3ccc. Report an issue: GitHub.