Web UI file picker saves %HOME% alias in log-file causing UnauthorizedAccessException

Support
1

Version: 2.3.0.1 (2.3.0.1_stable_2026-04-24)
OS: Windows 11 24H2

Issue Description

Selecting log-file destination via Web UI file picker using “Home” node saves path containing %HOME% alias. Backend engine fails to expand %HOME%, treats path as relative, and prepends install directory. This causes backup failure due to invalid path access.

Steps to Reproduce

  1. Open Duplicati Web UI.
  2. Edit backup job → Advanced options.
  3. Add log-file option.
  4. Use file picker, navigate via “Home” node to destination (IT\Windows\Programs).
  5. Specify filename. Option saves as: %HOME%\IT\Windows\Programs\Duplicati-Live_Log-Main_Backup_Job.log.
  6. Run backup.

Actual Result

Operation fails. Backend prepends C:\Program Files\Duplicati 2\ to path.
Error output:
UnauthorizedAccessException: Access to the path 'C:\Program Files\Duplicati 2\%HOME%\IT\Windows\Programs' is denied.

Expected Result

Backend expands %HOME% to correct absolute path (C:\Users\PC), OR Web UI saves absolute path directly.

Error Log

2026-05-10 21:17:25 +02 - [Error-Duplicati.Library.Main.Controller-FailedOperation]: The operation Backup has failed
UnauthorizedAccessException: Access to the path 'C:\Program Files\Duplicati 2\%HOME%\IT\Windows\Programs' is denied.
2

Thanks for reporting!

The issue is that for sources, we support “relative” paths, such as %HOME% because the system admin can choose to change the on-disk location of the actual home folder. By storing the “relative” path, we can resolve the actual on-disk path before running the backup and ensure that we always back up the “right” data.

This logic does not apply to non-source paths, but the file picker is re-used so it shows these and lets you pick them, which breaks things. The workaround is to ignore the shorthand folders, and then pick the actual path, starting from C:.

I have fixed it in source, so from the next release, you can pick the shorthand and it will store the absolute path. It will not update the path if the admin moves things around, but I think that is acceptable for things like a log-file path.

3

Thank you for the reply, I hope one day I can contribute to Duplicati so as to enable “relative” paths support for as many non-source paths.

Most importantly, thanks for the fix! :smiley: