octobercms/october · warning · ApplicationException

editor::lang.filesystem.invalid_path

Error message

editor::lang.filesystem.invalid_path

What it means

editorCreateDirectory runs validateFileSystemPath() on the new directory name. The validator accepts only characters matching /^[\@0-9a-z.\s_-\/]+$/i and rejects any occurrence of '..' or './'. A failure raises editor::lang.filesystem.invalid_path; for the create-directory flow this guards against traversal and characters that are unsafe in theme paths.

Source

Thrown at modules/editor/traits/FileSystemFunctions.php:31

 * FileSystemFunctions implements common file and directory management functions for Tailor extensions.
 */
trait FileSystemFunctions
{
    /**
     * editorCreateDirectory
     */
    protected function editorCreateDirectory($basePath, $newName, $parent)
    {
        if (!strlen($basePath)) {
            throw new SystemException('The directory base path must not be empty');
        }

        if (!strlen($newName)) {
            throw new ApplicationException(Lang::get('editor::lang.filesystem.directory_name_cant_be_empty'));
        }

        if (!$this->validateFileSystemPath($newName)) {
            throw new ApplicationException(Lang::get('editor::lang.filesystem.invalid_path'));
        }

        if (strlen($parent) && !$this->validateFileSystemPath($parent)) {
            throw new ApplicationException(Lang::get('editor::lang.filesystem.invalid_path'));
        }

        if (!$this->validateFileSystemName($newName)) {
            throw new ApplicationException(Lang::get('editor::lang.filesystem.invalid_name'));
        }

        $newFullPath = $basePath.'/'.$parent.'/'.$newName;
        if (file_exists($newFullPath) && is_dir($newFullPath)) {
            throw new ApplicationException(Lang::get('editor::lang.filesystem.already_exists'));
        }

        if (!File::makeDirectory($newFullPath, 0755, true, true)) {
            throw new ApplicationException(Lang::get(
                'editor::lang.filesystem.error_creating_directory',

View on GitHub (pinned to b608633a7e)

Solutions

  1. Use a plain name: letters, digits, dot, space, underscore, hyphen only (no slashes for a single directory name - see the invalid_name error for the name validator).
  2. Remove any '..' or './' sequences from the submitted value.
  3. ASCII-transliterate names containing accented or non-latin characters before submitting.
  4. Keep the parent directory in the separate parent field rather than embedding slashes in the name.

Example fix

// before
newName: '../partials'

// after
newName: 'partials', parent: ''
Defensive patterns

Strategy: validation

Validate before calling

/** Mirrors the editor's path whitelist: allowed chars, no '..' or './'. */
function isValidEditorPath(string $path): bool
{
    if (!preg_match('/^[\@0-9a-z\.\s_\-\/]+$/i', $path)) {
        return false;
    }
    return strpos($path, '..') === false && strpos($path, './') === false;
}

if (!isValidEditorPath($newName)) {
    throw new \ValidationException(['name' => 'Invalid characters or traversal sequence']);
}

Prevention

When it happens

Trigger: Submitting a directory name containing '..' (e.g. '../../modules') or './'; names with characters outside the allowed set such as '#', '(', ',', unicode letters, or a leading backslash; URL-encoded traversal payloads hitting the editor endpoint.

Common situations: Users pasting paths into the name field; scripts attempting path traversal through the editor API; names with accented or non-latin characters that the whitelist rejects.

Related errors

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/eb8e98e157c19b87. Report an issue: GitHub.