Getting "Invalid file path specified" after update from v2.2 to v3.7

kiko_balco · January 14, 2026, 11:51pm

Hi guys,
recently I updated one of my client’s website from v2.2 to v3.7.13 and I encountered weird issue that I wasn’t able to resolve yet.

When I try to access media on the backend, I am getting following error:

Invalid file path specified: '/Cenník - 2025 I.Q - 13.01.2025.pdf'.
~/modules/media/classes/MediaLibrary.php line 498

It looks like it is pointing to root folder instead of the media folder. I was checking settings in config files and in .env and evertyhing looks fine. I have correct path there '/storage/app/media

I also tried to turn off all plugins to see if the issue is not there, but with no effect.
I cleared the cache of course.

Do you have any clue what might be 'causing this problem.? It is present both on the local version of website and also on public hosting.

Also, files that are in media folder are accessbile from twig, so I can see them on the website, I just can’t manage media files or add new ones.

Thank you in advance for your answers.

Eoler · January 15, 2026, 10:17am

I’d be worried with that funny i in your pricelist filename, try to rename it first.

kiko_balco · January 15, 2026, 4:53pm

Well, it looks like it really has problem with diacritics. There was no problem with it in v2.2, but it looks like this is not allowed in v3.7. At leas when I upload files now through admin UI, it renames it so it doesn’t contain any diacritics or spaces.

Is it possible to allow it so I don’t need to rename a relink all the media files? It’s actually quite a lot of files in this project.

Eoler · January 16, 2026, 8:46am

OCv3.7 renames it in what way? I wasn’t aware, always used slugify on file upload from my plugin Curator plugin - October CMS so don’t know how to disable this behavior in OCv3+.

kiko_balco · January 16, 2026, 9:35am

Well, it slugifies a name on upload to media now in v3.7. This was not the case in v2.2. Therefor, now I have the media folder full of names with diacritis non-compatible with v3. Manually slugifing them a relinking them to specific items in system will be sort of a hell as there is couple of hundreds of files that needs this arrangement. But I guess I have no other option.

daftspunk · January 16, 2026, 9:39pm

Ah, yes. This came about from a security audit, and they prescribed that we use a “white list” when validating the file and folder names.

github.com

octobercms/october/blob/4.x/modules/media/classes/MediaLibrary.php#L469


      
          }
          
          
/**
           * validatePath checks if file path doesn't contain any substrings that would pose a security
           * threat. Returns a normalized path. Throws an exception if the path is not valid. An option
           * is provided, if only normalization is needed without validation.
           * @param string $path
           * @param bool $normalizeOnly
           * @return string
           */
          public static function validatePath($path, $normalizeOnly = false): string
          {
              $path = str_replace('\\', '/', $path);
              $path = '/'.trim($path, '/');
          
          
    if ($normalizeOnly) {
                  return $path;
              }
          
          
    // Validate folder names
              $regexAllowlist = [

I think here is comes from “any word character” (\w) that might be the problem?