openmediavault/openmediavault · error · OMV\Exception

The field 'path' contains forbidden two-dot symbols.

Error message

The field 'path' contains forbidden two-dot symbols.

What it means

The openmediavault folderbrowser RPC rejects any 'path' parameter containing the substring '..' before processing the request. Because the given canonicalized absolute path must remain below the shared folder/mount point, '..' sequences would allow path traversal outside the permitted root, so the engine throws this exception as a hard security guard.

Solutions

1. Canonicalize the path with realpath() and verify it stays under the shared folder before calling the RPC.
2. Reject any input containing '..' client-side with a friendly message.
3. Pass only absolute canonical paths already below the shared folder/mount point.
4. If access outside the shared folder is genuinely needed, use a mechanism with explicit permissions rather than folderbrowser.

Example fix

// before
$rpc->call('FolderBrowser', 'get', ['path' => $userPath, 'type' => 'sharedfolder']);
// after
$real = realpath($userPath);
if ($real === false || str_contains($real, '..') || !str_starts_with($real, $sharedFolderPath)) {
    throw new \InvalidArgumentException('path must stay inside the shared folder');
}
$rpc->call('FolderBrowser', 'get', ['path' => $real, 'type' => 'sharedfolder']);

$real = realpath($path);
if ($real === false || str_contains($real, '..') || !str_starts_with($real, $sharedFolderPath)) {
    throw new \InvalidArgumentException('path escapes shared folder');
}

function isSafeSubPath(string $path, string $root): bool {
    $r = realpath($path);
    $base = realpath($root);
    return $r !== false && $base !== false
        && !str_contains($r, '..')
        && str_starts_with($r, rtrim($base, '/') . '/');
}

try {
    $result = $rpc->call('FolderBrowser', 'get', $params);
} catch (\OMV\Exception $e) {
    if (str_contains($e->getMessage(), 'forbidden two-dot')) {
        throw new UserInputError('Path may not contain ..');
    }
    throw $e;
}

When it happens

Trigger: Calling the rpc.folderbrowser service method (e.g. get) with params['path'] containing '..' anywhere, such as '/sharedfolder/../../etc', typically from naive string concatenation of user input.

Common situations: A plugin or script passes a user-typed relative path into the folderbrowser RPC; a client attempts directory traversal to escape the shared folder root; legacy code from an older API that tolerated relative paths.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The field 'kind' contains forbidden two-dot symbols.
• The field 'reldirpath' contains forbidden two-dot symbols.
• The field 'file' contains forbidden two-dot symbols
• Unauthorized attempt to modify the system user account
• Unauthorized attempt to modify the system group account

AI-assisted analysis of openmediavault/openmediavault@dce610eb66 (2026-09-15). Data as JSON: /api/errors/a99b0766769f5fa2. Report an issue: GitHub.

Appendix: source

Thrown at deb/openmediavault/usr/share/openmediavault/engined/rpc/folderbrowser.inc:70

     *   or 'mntent'.
     *   \em path The relative directory path.
     * @param context The context of the caller.
     * @return array An array of directory names.
     * @ŧhrow \OMV\Exception
     */
    public function get($params, $context)
    {
        // Validate the RPC caller context.
        $this->validateMethodContext($context, [
            "role" => OMV_ROLE_ADMINISTRATOR
        ]);
        // Validate the parameters of the RPC service method.
        $this->validateMethodParams($params, "rpc.folderbrowser.get");
        // The field 'path' may not contain the characters '..'. This is
        // because of security reasons: the given canonicalized absolute
        // path MUST be below the given shared folder/mount point.
        if (1 == preg_match("/\.\./", $params['path'])) {
            throw new \OMV\Exception(
                "The field 'path' contains forbidden two-dot symbols."
            );
        }
        switch ($params['type']) {
            case "sharedfolder":
                // Get the absolute shared folder path.
                $rootPath = \OMV\Rpc\Rpc::call("ShareMgmt", "getPath", [
                    "uuid" => $params['uuid']
                ], $context);
                break;
            case "mntent":
                // Get the mount point configuration object.
                $db = \OMV\Config\Database::getInstance();
                $object = $db->get(
                    "conf.system.filesystem.mountpoint",
                    $params['uuid']
                );
                $rootPath = $object->get("dir");

View on GitHub (pinned to dce610eb66)