FlowiseAI/Flowise · error · Error

Invalid path characters detected

Error message

Invalid path characters detected

What it means

Thrown by BaseStorageProvider.validatePathSecurity when any of the supplied path components is flagged by isPathTraversal. It is a defense-in-depth check layered on top of per-component sanitization, catching traversal sequences in arbitrary path arguments (e.g. chatId).

Source

Thrown at packages/components/src/storage/BaseStorageProvider.ts:88

        return storagePath
    }

    /**
     * Shared utility for validating chatflowId format (UUID)
     */
    protected validateChatflowId(chatflowId: string): void {
        if (!chatflowId || !isValidUUID(chatflowId)) {
            throw new Error('Invalid chatflowId format - must be a valid UUID')
        }
    }

    /**
     * Shared utility for checking path traversal attempts
     */
    protected validatePathSecurity(...paths: string[]): void {
        for (const p of paths) {
            if (p && isPathTraversal(p)) {
                throw new Error('Invalid path characters detected')
            }
        }
    }

    /**
     * Shared utility for building a storage path from components
     */
    protected buildPath(...paths: string[]): string {
        const sanitizedPaths = paths.filter((p) => p && typeof p === 'string').map((p) => this.sanitizeFilename(p))
        return path.join(this.storagePath, ...sanitizedPaths)
    }
}

View on GitHub (pinned to abe4a8601a)

Solutions

1. Validate every user-supplied path segment (chatId, sub-folders) against a strict allowlist pattern before calling storage.
2. Reject any segment containing `..`, separators, or non-printable characters at the route handler.
3. Prefer opaque identifiers (UUIDs) for path components instead of free-form strings.

Example fix

// before
await provider.streamStorageFile(chatflowId, '../../../etc', fileName, orgId)
// after
if (!/^[-a-zA-Z0-9]+$/.test(chatId)) throw new Error('bad chatId')
await provider.streamStorageFile(chatflowId, chatId, fileName, orgId)

const SEGMENT_RE = /^[-a-zA-Z0-9_]+$/
function validatePathSegments(...segments: string[]): void {
  for (const s of segments) {
    if (s && !SEGMENT_RE.test(s)) throw new Error('Invalid path characters detected')
  }
}

function isSafePathSegment(s: unknown): s is string {
  return typeof s === 'string' && /^[-a-zA-Z0-9_]+$/.test(s)
}

When it happens

Trigger: A storage call where one of the path arguments contains `..`, absolute-path indicators, NUL bytes, or other traversal patterns detected by isPathTraversal. The loop at BaseStorageProvider.ts:85-87 checks each path.

Common situations: User-controlled chatId or sub-path values that are not validated at the API boundary; crafted requests targeting storage endpoints.

Related errors

• Invalid or unsafe fileName detected
• Invalid filename after sanitization
• Invalid chatflowId format - must be a valid UUID
• Invalid filename: unsafe characters or path traversal attemp
• Invalid path: path traversal attempt detected

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/6da20284c78577c6. Report an issue: GitHub.