ComposioHQ/composio · error · FileUploadPathNotAllowedError

Refusing to auto-upload "{attempted}": no upload directories

Error message

Refusing to auto-upload "{attempted}": no upload directories are configured.

What it means

assert_path_inside_upload_dirs refuses any auto-upload when the file_upload_dirs allowlist is empty — with no configured directories there is no safe boundary, so FileUploadPathNotAllowedError is raised telling you to configure `file_upload_dirs` first.

Source

Thrown at python/composio/utils/upload_dir_allowlist.py:183

                    "",
                    "Common causes:",
                    "  - Typo in the filename passed to the tool.",
                    "  - Relative path resolved against the wrong working directory",
                    "    (relative paths use os.getcwd() at the moment of upload).",
                    "  - File was deleted between the tool being called and the upload starting.",
                    "",
                    _build_help_footer(allowlist),
                ]
            )
        )

    try:
        real_path = abs_path.resolve(strict=True)
    except OSError:
        real_path = abs_path

    if not allowlist:
        raise FileUploadPathNotAllowedError(
            "\n".join(
                [
                    f'Refusing to auto-upload "{attempted}": no upload directories are configured.',
                    "",
                    f"Path attempted:   {attempted}",
                    f"Resolved to:      {real_path}",
                    "",
                    "Automatic file upload during tool execution is locked down by default",
                    "to prevent a prompt-injected tool from exfiltrating server files",
                    "(source code, .env, SSH keys, etc.).",
                    _build_help_footer(allowlist),
                ]
            )
        )

    for dir_entry in allowlist:
        if is_inside_dir(real_path, resolve_root(dir_entry)):
            return

View on GitHub (pinned to 64b1b85502)

Solutions

Configure the allowlist explicitly: Composio(api_key=..., file_upload_dirs=[str(project_root)]) covering exactly the directories you want uploadable
If config comes from env/yaml, validate it's non-empty before constructing the client
Scope the dirs narrowly (e.g. only ./uploads) instead of the whole home directory
If you didn't intend auto-upload, switch to an explicit upload API that takes bytes/streams

Example fix

# before
composio = Composio(api_key=KEY)  # no file_upload_dirs
upload.from_path("./report.pdf")
# after
composio = Composio(api_key=KEY, file_upload_dirs=[str(Path.cwd())])
upload.from_path("./report.pdf")

Defensive patterns

Strategy: validation

Validate before calling

from pathlib import Path
composio = Composio(api_key=KEY, file_upload_dirs=[str(Path.cwd())])
assert composio.file_upload_dirs, "upload dirs must be configured before auto-upload"

Try / catch

from composio.exceptions import FileUploadPathNotAllowedError
try:
    upload.from_path(p)
except FileUploadPathNotAllowedError as e:
    if "no upload directories" in str(e):
        raise ConfigError("set file_upload_dirs on Composio") from e

Prevention

Configure file_upload_dirs at client construction, not per-call
Validate config sources (env/yaml) yield a non-empty list
Scope allowlists to dedicated upload directories

When it happens

Trigger: Using file auto-upload features (from_path and callers) on a Composio client where file_upload_dirs was never set or was set to an empty list — the safety default is deny-all.

Common situations: New integrations that didn't opt in to upload dirs; refactor removing the config; environment/config loading silently yielding [] (missing env var parsed as empty); upgrading SDK versions where the allowlist became mandatory for auto-upload.

Related errors

AI-assisted analysis of ComposioHQ/composio@64b1b85502 (2026-08-28). Data as JSON: /api/errors/07e79aedb740e83c. Report an issue: GitHub.