Absolute paths set for tempFileDir are not handled properly

[rktyt]

Describe the Bug

payload.config.ts:

import { buildConfig } from 'payload'
import { tmpdir } from 'node:os'

export default buildConfig({
  ....
  upload: {
    tempFileDir: tmpdir(),
    useTempFiles: true,
  },
  ....
})

collection:

import type { CollectionConfig } from 'payload'

export const Media: CollectionConfig = {
  slug: 'media',
  fields: [],
  upload: true,
  hooks: {
    beforeOperation: [
      async ({ operation, req }) => {
        if ((operation === 'create' || operation === 'update') && req.file) {
          throw new Error('force stop')
        }
      },
    ]
  },
}

---

Code of v3.43.0:

payload/packages/payload/src/uploads/fetchAPI-multipart/handlers.ts

Lines 23 to 25 in 053192c

	export const tempFileHandler: Handler = (options, fieldname, filename) => {
	const dir = path.normalize(options.tempFileDir!)
	const tempFilePath = path.join(process.cwd(), dir, getTempFilename())

There should be a check to verify whether dir is an absolute path using path.isAbsolute(dir).

---

There is no mention of any path restrictions in the documentation (https://payloadcms.com/docs/upload/overview#payload-wide-upload-options).

Link to the code that reproduces this issue

https://github.com/payloadcms/payload

Reproduction Steps

1. Specify an absolute path for tempFileDir
2. Upload file
3. Check where the temporary file is created

Which area(s) are affected? (Select all that apply)

area: core

Environment Info

Binaries:
  Node: 22.16.0
  npm: 11.4.2
  Yarn: 1.22.22
  pnpm: 10.11.0
Relevant Packages:
  payload: 3.43.0
  next: 15.3.4
  @payloadcms/db-mongodb: 3.43.0
  @payloadcms/db-postgres: 3.43.0
  @payloadcms/email-nodemailer: 3.43.0
  @payloadcms/graphql: 3.43.0
  @payloadcms/next/utilities: 3.43.0
  @payloadcms/payload-cloud: 3.43.0
  @payloadcms/plugin-cloud-storage: 3.43.0
  @payloadcms/richtext-lexical: 3.43.0
  @payloadcms/storage-s3: 3.43.0
  @payloadcms/translations: 3.43.0
  @payloadcms/ui/shared: 3.43.0
  react: 19.1.0
  react-dom: 19.1.0
Operating System:
  Platform: linux
  Arch: arm64
  Version: #1 SMP Tue Apr 15 16:00:54 UTC 2025
  Available memory (MB): 23998
  Available CPU cores: 10

[sanbrien]

I can confirm this problem in Payload 3.61.1.

[SteveTalbot]

A workaround (tested with Payload 3.70.0) is to create a symlink inside the working directory to the absolute path of the temporary directory, so for example ln -s /tmp /var/workdir/tmp, then you can set tempFileDir to the absolute path /tmp and it works as expected.

Maybe the original developer intended path.resolve() instead of path.join() in packages/payload/src/uploads/fetchAPI-multipart/handlers.ts#L25 ?