FlowiseAI/Flowise · warning · Error

File type not allowed: files must have a valid file extensio

Error message

File type not allowed: files must have a valid file extension

What it means

Thrown by validateMimeTypeAndExtensionMatch when extractFileExtension returns '' — i.e. the filename has no dot or nothing after the last dot. Files without extensions are rejected for security because there is no extension to match against the declared MIME type, defeating the spoofing mitigation (CVE-2025-61687).

Source

Thrown at packages/components/src/validator.ts:153

 * It ensures that the file extension matches the declared MIME type, preventing
 * attackers from uploading malicious files (e.g., .js file with text/plain MIME type).
 *
 * @param {string} filename The original filename
 * @param {string} mimetype The declared MIME type
 * @returns {void} Throws an error if validation fails
 */
export const validateMimeTypeAndExtensionMatch = (filename: string, mimetype: string): void => {
    validateFilename(filename)

    if (!mimetype || typeof mimetype !== 'string') {
        throw new Error('Invalid MIME type: MIME type is required and must be a string')
    }

    const normalizedExt = extractFileExtension(filename)

    if (!normalizedExt) {
        // Files without extensions are rejected for security
        throw new Error('File type not allowed: files must have a valid file extension')
    }

    // Get the expected extension from mapMimeTypeToExt (returns extension without dot)
    const expectedExt = mapMimeTypeToExt(mimetype)

    if (!expectedExt) {
        // If mapMimeTypeToExt doesn't recognize the MIME type, it's not supported
        throw new Error(`MIME type "${mimetype}" is not supported or does not have a valid file extension mapping`)
    }

    // Ensure the file extension matches the expected extension for the MIME type
    if (normalizedExt !== expectedExt) {
        throw new Error(
            `MIME type mismatch: file extension "${normalizedExt}" does not match declared MIME type "${mimetype}". Expected: ${expectedExt}`
        )
    }
}

View on GitHub (pinned to abe4a8601a)

Solutions

1. Require clients to include a file extension; reject extensionless uploads with a 400.
2. If extensionless uploads must be supported, derive the extension from the declared MIME type and append it before storage (and document the security trade-off).
3. Update the uploader to send the original filename with extension.

Example fix

// before
if (!normalizedExt) throw new Error('File type not allowed: files must have a valid file extension')

// after — auto-append extension from MIME when policy allows extensionless uploads
if (!normalizedExt) {
  const derived = mapMimeTypeToExt(mimetype)
  if (derived) {
    filename = `${filename}.${derived}`
  } else {
    throw new Error('File type not allowed: files must have a valid file extension')
  }
}

function filenameHasExtension(filename: string): boolean {
  const parts = filename.split('.')
  return parts.length > 1 && parts[parts.length - 1].length > 0
}

function hasFileExtension(filename: string): boolean {
  const parts = filename.split('.')
  return parts.length > 1 && parts[parts.length - 1].trim().length > 0
}

if (!hasFileExtension(filename)) {
  throw new Error('File type not allowed: files must have a valid file extension')
}

When it happens

Trigger: Uploader sends filename='receipt' (no extension) or filename='receipt.' (trailing dot, empty final segment); a renamed file stripped of its extension; a generated/temporary filename like 'tmp-12345'.

Common situations: Mobile clients that strip extensions; temp file uploads; CSV/JSON content uploaded as extensionless 'data'; legacy systems storing files by ID only.

Related errors

• Invalid MIME type: MIME type is required and must be a strin
• MIME type "${mimetype}" is not supported or does not have a
• Invalid filename: filename is required and must be a string
• Invalid filename: unsafe characters or path traversal attemp
• MIME type mismatch: file extension "${normalizedExt}" does n

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/de69679a6e237885. Report an issue: GitHub.