FlowiseAI/Flowise · error · Error

Invalid path: Extended-length paths are not allowed

Error message

Invalid path: Extended-length paths are not allowed

What it means

Thrown by validateVectorStorePath (packages/components/src/validator.ts:252) when the base path matches ^\\\\\?\\ — a Windows extended-length path such as '\\\\?\\C:\\Very\\Long\\Path'. These bypass MAX_PATH limits and several normalization rules, so Flowise rejects them.

Source

Thrown at packages/components/src/validator.ts:252

    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c')) {
        throw new Error('Invalid path: encoded path traversal attempt detected')
    }

    // Check for null bytes and control characters
    if (/\0/.test(basePath) || /[\x00-\x1f]/.test(basePath)) {
        throw new Error('Invalid path: null bytes or control characters detected')
    }

    // Check for Windows-specific absolute paths and UNC paths (even on Unix systems)
    // This prevents cross-platform attack vectors
    if (/^[a-zA-Z]:\\/.test(basePath)) {
        throw new Error('Invalid path: Windows absolute paths are not allowed')
    }
    if (/^\\\\[^\\]/.test(basePath)) {
        throw new Error('Invalid path: UNC paths are not allowed')
    }
    if (/^\\\\\?\\/.test(basePath)) {
        throw new Error('Invalid path: Extended-length paths are not allowed')
    }

    // Resolve to absolute path
    // If path is relative, resolve it relative to the .flowise directory (safe default)
    // If path is already absolute, keep it as-is
    let resolvedPath: string
    if (path.isAbsolute(basePath)) {
        resolvedPath = path.resolve(basePath)
    } else {
        // Relative paths are resolved within the .flowise directory for safety
        resolvedPath = path.resolve(path.join(getUserHome(), '.flowise', basePath))
    }

    // Verify the resolved path doesn't contain '..' after resolution
    if (resolvedPath.includes('..')) {
        throw new Error('Invalid path: path traversal detected in resolved path')
    }

View on GitHub (pinned to abe4a8601a)

Solutions

1. Drop the '\\\\?\\' prefix and use a plain path under an allowed dir.
2. Shorten the directory structure so no extended-length prefix is needed.
3. Move the data under ~/.flowise and use a short relative name.

Example fix

// before
basePath = '\\\\?\\C:\\Users\\me\\deep\\...\\vectors'

// after
basePath = 'vectors'   // moved under ~/.flowise/vectors

if (/^\\\\\?\\/.test(String(basePath ?? ''))) throw new Error('extended-length path prefix not allowed');

const isNotExtendedLength = (p: unknown): p is string => typeof p === 'string' && !/^\\\\\?\\/.test(p);

try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /Extended-length/.test(e.message)) { basePath = basePath.replace(/^\\\\\?\\/, '') } else throw e }

When it happens

Trigger: A node config contains an extended-length path prefix, typically copied from PowerShell or a tool that emits '\\\\?\\' prefixes for long paths.

Common situations: Long Windows paths auto-prefixed by tooling; PowerShell Get-Item outputs; migration of deep directory trees into Flowise.

Related errors

• Invalid path: Windows absolute paths are not allowed
• Invalid path: UNC paths are not allowed
• Invalid path: path traversal attempt detected
• Invalid path: encoded path traversal attempt detected
• Invalid path: null bytes or control characters detected

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/488e542478936867. Report an issue: GitHub.