FlowiseAI/Flowise · error · Error

Invalid chatflowId format - must be a valid UUID

Error message

Invalid chatflowId format - must be a valid UUID

What it means

Thrown by BaseStorageProvider.validateChatflowId when the supplied chatflowId is missing or does not pass isValidUUID. UUID validation prevents a caller from injecting path segments or traversal sequences through the chatflowId component of a storage path.

Source

Thrown at packages/components/src/storage/BaseStorageProvider.ts:78

     * Shared utility for getting the base storage path
     */
    protected getStoragePath(): string {
        const storagePath = process.env.BLOB_STORAGE_PATH
            ? path.join(process.env.BLOB_STORAGE_PATH)
            : path.join(getUserHome(), '.flowise', 'storage')

        if (!fs.existsSync(storagePath)) {
            fs.mkdirSync(storagePath, { recursive: true })
        }
        return storagePath
    }

    /**
     * Shared utility for validating chatflowId format (UUID)
     */
    protected validateChatflowId(chatflowId: string): void {
        if (!chatflowId || !isValidUUID(chatflowId)) {
            throw new Error('Invalid chatflowId format - must be a valid UUID')
        }
    }

    /**
     * Shared utility for checking path traversal attempts
     */
    protected validatePathSecurity(...paths: string[]): void {
        for (const p of paths) {
            if (p && isPathTraversal(p)) {
                throw new Error('Invalid path characters detected')
            }
        }
    }

    /**
     * Shared utility for building a storage path from components
     */
    protected buildPath(...paths: string[]): string {

View on GitHub (pinned to abe4a8601a)

Solutions

1. Confirm the chatflowId is a valid UUID (v4) before invoking any storage method.
2. Validate the parameter at the API boundary (e.g. with a UUID route constraint or Zod schema).
3. Return 400 to the client on invalid IDs rather than letting them reach storage.

Example fix

// before
await provider.streamStorageFile(req.params.id, chatId, fileName, orgId)
// after
const chatflowId = req.params.id
if (!isValidUUID(chatflowId)) return res.status(400).send('invalid chatflowId')
await provider.streamStorageFile(chatflowId, chatId, fileName, orgId)

const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
function requireValidChatflowId(id: string): void {
  if (!id || !UUID_RE.test(id)) throw new Error('Invalid chatflowId format - must be a valid UUID')
}

function isValidChatflowId(id: unknown): id is string {
  return typeof id === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id)
}

When it happens

Trigger: Any storage call (read, write, list, delete) where chatflowId is undefined, an empty string, a malformed UUID, or a deliberately injected value like `../../`. The guard is `!chatflowId || !isValidUUID(chatflowId)` at BaseStorageProvider.ts:77.

Common situations: A route handler that forgets to validate the chatflowId param; a stale/bookmarked URL with a truncated ID; an attack probing the storage endpoint with crafted IDs.

Related errors

• Invalid or unsafe fileName detected
• Invalid filename after sanitization
• Invalid path characters detected
• Invalid flow ID: must be a valid UUID
• Invalid agentflow ID: must be a valid UUID

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/afd9d431667cd786. Report an issue: GitHub.