diff --git a/server/knowledge_base/kb_service/base.py b/server/knowledge_base/kb_service/base.py
index c83753d54c..5990903e65 100644
--- a/server/knowledge_base/kb_service/base.py
+++ b/server/knowledge_base/kb_service/base.py
@@ -194,14 +194,14 @@ def update_doc_by_ids(self, docs: Dict[str, Document]) -> bool:
         如果对应 doc_id 的值为 None，或其 page_content 为空，则删除该文档
         '''
         self.del_doc_by_ids(list(docs.keys()))
-        docs = []
+        pending_docs = []
         ids = []
-        for k, v in docs.items():
-            if not v or not v.page_content.strip():
+        for _id, doc in docs.items():
+            if not doc or not doc.page_content.strip():
                 continue
-            ids.append(k)
-            docs.append(v)
-        self.do_add_doc(docs=docs, ids=ids)
+            ids.append(_id)
+            pending_docs.append(doc)
+        self.do_add_doc(docs=pending_docs, ids=ids)
         return True
 
     def list_docs(self, file_name: str = None, metadata: Dict = {}) -> List[DocumentWithVSId]:
diff --git a/server/knowledge_base/utils.py b/server/knowledge_base/utils.py
index f2ddbfd012..d83124ac06 100644
--- a/server/knowledge_base/utils.py
+++ b/server/knowledge_base/utils.py
@@ -42,7 +42,10 @@ def get_vs_path(knowledge_base_name: str, vector_name: str):
 
 
 def get_file_path(knowledge_base_name: str, doc_name: str):
-    return os.path.join(get_doc_path(knowledge_base_name), doc_name)
+    doc_path = Path(get_doc_path(knowledge_base_name)).resolve()
+    file_path = (doc_path / doc_name).resolve()
+    if str(file_path).startswith(str(doc_path)):
+        return str(file_path)
 
 
 def list_kbs_from_folder():