Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

[Auto] [Backend] GET /api/v1/dms/files/e042718c-d679-4c63-ad1f-15a6c735f69d/preview: Path traversal detected: /tmp/dms/bfe4d09e-e84d-4e01-ba00-8bc2aa49e5aa/e042718c-d679-4c63-ad1f-15a6c735f69d #38

New Issue
Open
opened 2026-07-27 06:59:36 +00:00 by Leopoldadmin · 0 comments
Leopoldadmin commented 2026-07-27 06:59:36 +00:00
Owner
Copy Link
Copy Source

Error Report

Message: [Backend] GET /api/v1/dms/files/e042718c-d679-4c63-ad1f-15a6c735f69d/preview: Path traversal detected: /tmp/dms/bfe4d09e-e84d-4e01-ba00-8bc2aa49e5aa/e042718c-d679-4c63-ad1f-15a6c735f69d

Stack:

Traceback (most recent call last):
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 148, in call_next
    message = await recv_stream.receive()
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/appuser/.local/lib/python3.12/site-packages/anyio/streams/memory.py", line 133, in receive
    raise EndOfStream from None
anyio.EndOfStream

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/app/app/main.py", line 76, in dispatch
    response = await call_next(request)
               ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 156, in call_next
    raise app_exc
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 141, in coro
    await self.app(scope, receive_or_disconnect, send_no_error)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 176, in __call__
    with recv_stream, send_stream, collapse_excgroups():
                                   ^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/contextlib.py", line 158, in __exit__
    self.gen.throw(value)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_utils.py", line 82, in collapse_excgroups
    raise exc
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 178, in __call__
    response = await self.dispatch_func(request, call_next)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/app/core/middleware.py", line 21, in dispatch
    response = await call_next(request)
               ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 156, in call_next
    raise app_exc
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 141, in coro
    await self.app(scope, receive_or_disconnect, send_no_error)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 176, in __call__
    with recv_stream, send_stream, collapse_excgroups():
                                   ^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/contextlib.py", line 158, in __exit__
    self.gen.throw(value)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_utils.py", line 82, in collapse_excgroups
    raise exc
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 178, in __call__
    response = await self.dispatch_func(request, call_next)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/app/core/middleware.py", line 137, in dispatch
    return await call_next(request)
           ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 156, in call_next
    raise app_exc
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 141, in coro
    await self.app(scope, receive_or_disconnect, send_no_error)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/cors.py", line 85, in __call__
    await self.app(scope, receive, send)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/exceptions.py", line 62, in __call__
    await wrap_app_handling_exceptions(self.app, conn)(scope, receive, send)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 53, in wrapped_app
    raise exc
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 42, in wrapped_app
    await app(scope, receive, sender)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/routing.py", line 714, in __call__
    await self.middleware_stack(scope, receive, send)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/routing.py", line 734, in app
    await route.handle(scope, receive, send)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/routing.py", line 288, in handle
    await self.app(scope, receive, send)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/routing.py", line 76, in app
    await wrap_app_handling_exceptions(app, request)(scope, receive, send)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 53, in wrapped_app
    raise exc
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 42, in wrapped_app
    await app(scope, receive, sender)
  File "/home/appuser/.local/lib/python3.12/site-packages/starlette/routing.py", line 73, in app
    response = await f(request)
               ^^^^^^^^^^^^^^^^
  File "/home/appuser/.local/lib/python3.12/site-packages/fastapi/routing.py", line 301, in app
    raw_response = await run_endpoint_function(
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/appuser/.local/lib/python3.12/site-packages/fastapi/routing.py", line 212, in run_endpoint_function
    return await dependant.call(**values)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/app/plugins/builtins/dms/routes.py", line 783, in preview_file
    if not await storage.exists(dms_file.storage_path):
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/app/core/storage.py", line 117, in exists
    return os.path.exists(self._full_path(path))
                          ^^^^^^^^^^^^^^^^^^^^^
  File "/app/app/core/storage.py", line 81, in _full_path
    raise ValueError(f"Path traversal detected: {path}")
ValueError: Path traversal detected: /tmp/dms/bfe4d09e-e84d-4e01-ba00-8bc2aa49e5aa/e042718c-d679-4c63-ad1f-15a6c735f69d

URL: http://crm.media-on.de/api/v1/dms/files/e042718c-d679-4c63-ad1f-15a6c735f69d/preview

Context:

{
  "method": "GET",
  "path": "/api/v1/dms/files/e042718c-d679-4c63-ad1f-15a6c735f69d/preview",
  "source": "backend_middleware"
}
## Error Report **Message:** [Backend] GET /api/v1/dms/files/e042718c-d679-4c63-ad1f-15a6c735f69d/preview: Path traversal detected: /tmp/dms/bfe4d09e-e84d-4e01-ba00-8bc2aa49e5aa/e042718c-d679-4c63-ad1f-15a6c735f69d **Stack:** ``` Traceback (most recent call last): File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 148, in call_next message = await recv_stream.receive() ^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/appuser/.local/lib/python3.12/site-packages/anyio/streams/memory.py", line 133, in receive raise EndOfStream from None anyio.EndOfStream During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/app/app/main.py", line 76, in dispatch response = await call_next(request) ^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 156, in call_next raise app_exc File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 141, in coro await self.app(scope, receive_or_disconnect, send_no_error) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 176, in __call__ with recv_stream, send_stream, collapse_excgroups(): ^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/contextlib.py", line 158, in __exit__ self.gen.throw(value) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_utils.py", line 82, in collapse_excgroups raise exc File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 178, in __call__ response = await self.dispatch_func(request, call_next) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/app/core/middleware.py", line 21, in dispatch response = await call_next(request) ^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 156, in call_next raise app_exc File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 141, in coro await self.app(scope, receive_or_disconnect, send_no_error) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 176, in __call__ with recv_stream, send_stream, collapse_excgroups(): ^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/contextlib.py", line 158, in __exit__ self.gen.throw(value) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_utils.py", line 82, in collapse_excgroups raise exc File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 178, in __call__ response = await self.dispatch_func(request, call_next) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/app/core/middleware.py", line 137, in dispatch return await call_next(request) ^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 156, in call_next raise app_exc File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 141, in coro await self.app(scope, receive_or_disconnect, send_no_error) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/cors.py", line 85, in __call__ await self.app(scope, receive, send) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/middleware/exceptions.py", line 62, in __call__ await wrap_app_handling_exceptions(self.app, conn)(scope, receive, send) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 53, in wrapped_app raise exc File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 42, in wrapped_app await app(scope, receive, sender) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/routing.py", line 714, in __call__ await self.middleware_stack(scope, receive, send) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/routing.py", line 734, in app await route.handle(scope, receive, send) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/routing.py", line 288, in handle await self.app(scope, receive, send) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/routing.py", line 76, in app await wrap_app_handling_exceptions(app, request)(scope, receive, send) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 53, in wrapped_app raise exc File "/home/appuser/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 42, in wrapped_app await app(scope, receive, sender) File "/home/appuser/.local/lib/python3.12/site-packages/starlette/routing.py", line 73, in app response = await f(request) ^^^^^^^^^^^^^^^^ File "/home/appuser/.local/lib/python3.12/site-packages/fastapi/routing.py", line 301, in app raw_response = await run_endpoint_function( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/appuser/.local/lib/python3.12/site-packages/fastapi/routing.py", line 212, in run_endpoint_function return await dependant.call(**values) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/app/plugins/builtins/dms/routes.py", line 783, in preview_file if not await storage.exists(dms_file.storage_path): ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/app/core/storage.py", line 117, in exists return os.path.exists(self._full_path(path)) ^^^^^^^^^^^^^^^^^^^^^ File "/app/app/core/storage.py", line 81, in _full_path raise ValueError(f"Path traversal detected: {path}") ValueError: Path traversal detected: /tmp/dms/bfe4d09e-e84d-4e01-ba00-8bc2aa49e5aa/e042718c-d679-4c63-ad1f-15a6c735f69d ``` **URL:** http://crm.media-on.de/api/v1/dms/files/e042718c-d679-4c63-ad1f-15a6c735f69d/preview **Context:** ```json { "method": "GET", "path": "/api/v1/dms/files/e042718c-d679-4c63-ad1f-15a6c735f69d/preview", "source": "backend_middleware" } ```
Leopoldadmin added the auto-reportedbug labels 2026-07-27 06:59:36 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-reported
Automatically reported by error reporter
 bug
Bug report
 bug
Bug Report
 critical
Critical Priority
 enhancement
Feature Request
 high
High Priority
 low
Low Priority
 medium
Medium Priority
 task
Roadmap Task
No Label auto-reported bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Leopoldadmin
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Leopoldadmin/leocrm#38
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?