FlowiseAI/Flowise · error · Error

Invalid file path

Error message

Invalid file path

What it means

First of three defense-in-depth guards in LocalStorageProvider.streamStorageFile. After buildPath constructs the absolute path, it asserts the result is absolute. A non-absolute result would indicate BLOB_STORAGE_PATH or getUserHome() resolved to a relative base, which the provider refuses to serve from.

Source

Thrown at packages/components/src/storage/LocalStorageProvider.ts:135

            throw error
        }
    }

    async streamStorageFile(
        chatflowId: string,
        chatId: string,
        fileName: string,
        orgId: string
    ): Promise<fs.ReadStream | Buffer | undefined> {
        // Validate chatflowId and chatId
        this.validateChatflowId(chatflowId)
        this.validatePathSecurity(chatflowId, chatId)

        const sanitizedFilename = this.sanitizeFilename(fileName)
        const filePath = this.buildPath(orgId, chatflowId, chatId, sanitizedFilename)

        //raise error if file path is not absolute
        if (!path.isAbsolute(filePath)) throw new Error(`Invalid file path`)
        //raise error if file path contains '..'
        if (filePath.includes('..')) throw new Error(`Invalid file path`)
        //only return from the storage folder
        if (!filePath.startsWith(this.storagePath)) throw new Error(`Invalid file path`)

        if (fs.existsSync(filePath)) {
            return fs.createReadStream(filePath)
        } else {
            // Fallback: Check if file exists without orgId
            const fallbackPath = this.buildPath(chatflowId, chatId, sanitizedFilename)

            if (fs.existsSync(fallbackPath)) {
                // Create directory if it doesn't exist
                const dir = path.dirname(filePath)
                if (!fs.existsSync(dir)) {
                    fs.mkdirSync(dir, { recursive: true })
                }

View on GitHub (pinned to abe4a8601a)

Solutions

1. Set BLOB_STORAGE_PATH to an absolute path, e.g. `/var/lib/flowise/storage`.
2. Ensure HOME (or the platform equivalent) is defined for the process so the default storage path resolves absolutely.
3. Restart Flowise after correcting the env var.

Example fix

# before
BLOB_STORAGE_PATH=./storage
# after
BLOB_STORAGE_PATH=/var/lib/flowise/storage

function requireAbsoluteStoragePath(): string {
  const p = process.env.BLOB_STORAGE_PATH || path.join(getUserHome(), '.flowise', 'storage')
  if (!path.isAbsolute(p)) throw new Error('BLOB_STORAGE_PATH must be an absolute path')
  return p
}

function isAbsoluteStoragePath(p: string): boolean {
  return path.isAbsolute(p)
}

When it happens

Trigger: BLOB_STORAGE_PATH set to a relative value (e.g. `./storage`) or the user home resolution failing, so path.join produces a relative filePath. The guard is `!path.isAbsolute(filePath)` at LocalStorageProvider.ts:135.

Common situations: Setting BLOB_STORAGE_PATH to a relative path in .env; running under a service account whose HOME is unset so getUserHome() returns a relative fallback.

Related errors

• Security validation failed: ${error.message}
• Custom MCP script execution disabled. Configure CUSTOM_MCP_A
• Environment variable '${key}' is not allowed. Permitted: ${[
• Invalid server configuration
• cwd parameter is not allowed in MCP server configuration

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/750718f53bdf93c2. Report an issue: GitHub.