LocalAI/core
LocalAI [bot] 70cf8ac546
fix(backend): resolve relative draft_model paths against the models dir (#9680)
* fix(backend): resolve relative draft_model paths against the models dir

The main model file and mmproj are joined with the configured models
directory before reaching the backend, but draft_model was sent
verbatim. With a relative draft_model in the YAML config, llama.cpp
opens the path from the backend process's CWD and fails with "No such
file or directory", forcing users to hard-code an absolute path.

Mirror the existing mmproj resolution: if draft_model is relative,
join it with modelPath. Absolute paths are passed through unchanged.

Adds an e2e regression test against the mock backend that asserts the
main model file, mmproj, and draft_model all arrive at the backend
resolved to absolute paths.

Closes #9675

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:claude-opus-4-7-1m [Read] [Edit] [Bash] [Write]

* fix(backend): always join draft_model with models dir (drop IsAbs shortcut)

The previous commit kept absolute draft_model paths intact via an
IsAbs check. That left a path-traversal vector open: a user-supplied
YAML config could set draft_model to /etc/passwd (or any other host
file the backend process can read) and the path would be sent through
unchanged.

filepath.Join cleans the leading slash from absolute components, so
joining unconditionally — the way mmproj already does — keeps the
result rooted at the configured models directory regardless of input.

Adds a second e2e spec that feeds an absolute draft_model into the
mock backend and asserts the path is clamped under modelsPath.

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:claude-opus-4-7-1m [Read] [Edit] [Bash]

---------

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
2026-05-06 00:58:38 +02:00
..
application feat(concurrency-groups): per-model exclusive groups for backend loading (#9662) 2026-05-05 08:42:50 +02:00
backend fix(backend): resolve relative draft_model paths against the models dir (#9680) 2026-05-06 00:58:38 +02:00
cli feat: support word-level timestamps for faster-whisper (#9621) 2026-05-06 00:32:52 +02:00
clients feat: add distributed mode (#9124) 2026-03-30 00:47:27 +02:00
config feat(api): add /v1/audio/diarization endpoint with sherpa-onnx + vibevoice.cpp (#9654) 2026-05-05 15:10:13 +02:00
dependencies_manager feat(ui): move to React for frontend (#8772) 2026-03-05 21:47:12 +01:00
explorer feat: add distributed mode (#9124) 2026-03-30 00:47:27 +02:00
gallery feat(importers): whisper.cpp HF repos pick a quant + nest under whisper/models (#9630) 2026-05-01 12:03:07 +02:00
http feat: support word-level timestamps for faster-whisper (#9621) 2026-05-06 00:32:52 +02:00
p2p feat: add distributed mode (#9124) 2026-03-30 00:47:27 +02:00
schema feat: support word-level timestamps for faster-whisper (#9621) 2026-05-06 00:32:52 +02:00
services fix(distributed): scope Upgrade All to nodes that have the backend installed (#9678) 2026-05-06 00:28:41 +02:00
startup feat: add distributed mode (#9124) 2026-03-30 00:47:27 +02:00
templates fix(vision): propagate mtmd media marker from backend via ModelMetadata (#9412) 2026-04-18 20:30:13 +02:00
trace feat: add LocalVQE backend and audio transformations UI (#9640) 2026-05-04 22:07:11 +02:00