FlowiseAI/Flowise · error · Error

Invalid path: path must be within allowed directories (${all

Error message

Invalid path: path must be within allowed directories (${allowedDirs.join(', ')}). Attempted path: ${resolvedPath}

What it means

Thrown by validateVectorStorePath (packages/components/src/validator.ts:280) when the fully resolved absolute path is not inside any allowed base directory. Allowed dirs are ~/.flowise plus BLOB_STORAGE_PATH (if set). The error message names the allowed dirs and the attempted path to aid debugging.

Source

Thrown at packages/components/src/validator.ts:280

        // Relative paths are resolved within the .flowise directory for safety
        resolvedPath = path.resolve(path.join(getUserHome(), '.flowise', basePath))
    }

    // Verify the resolved path doesn't contain '..' after resolution
    if (resolvedPath.includes('..')) {
        throw new Error('Invalid path: path traversal detected in resolved path')
    }

    // Check if resolved path is within allowed directories
    const allowedDirs = getAllowedVectorStoreBaseDirs()
    const isWithinAllowedDir = allowedDirs.some((allowedDir) => {
        const normalizedResolved = normalizePlatformPath(resolvedPath)
        const normalizedAllowed = normalizePlatformPath(allowedDir)
        return normalizedResolved === normalizedAllowed || normalizedResolved.startsWith(normalizedAllowed + path.sep)
    })

    if (!isWithinAllowedDir) {
        throw new Error(
            `Invalid path: path must be within allowed directories (${allowedDirs.join(', ')}). ` + `Attempted path: ${resolvedPath}`
        )
    }

    return resolvedPath
}

const getAllowedSQLiteBaseDirs = (): string[] => {
    const dirs = [path.join(getUserHome(), '.flowise')]
    if (process.env.DATABASE_PATH) {
        dirs.push(path.resolve(process.env.DATABASE_PATH))
    }
    return dirs
}

const normalizePlatformPath = (p: string): string => {
    const n = path.normalize(p)
    return process.platform === 'win32' ? n.toLowerCase() : n

View on GitHub (pinned to abe4a8601a)

Solutions

1. Set BLOB_STORAGE_PATH=/your/data/dir and use paths inside it.
2. Use a relative name so Flowise resolves under ~/.flowise automatically.
3. Symlink your target directory into ~/.flowise and reference the symlink by its relative name.
4. Confirm HOME (or USERPROFILE on Windows) points where you expect — getUserHome() drives ~/.flowise.

Example fix

// before
process.env.BLOB_STORAGE_PATH = ''   // unset
nodeParams.basePath = '/mnt/data/vectors'

// after
process.env.BLOB_STORAGE_PATH = '/mnt/data'
nodeParams.basePath = '/mnt/data/vectors'   // now inside the allow-list

const { resolve, join } = require('path');
const allowed = [join(require('os').homedir(), '.flowise')];
if (process.env.BLOB_STORAGE_PATH) allowed.push(resolve(process.env.BLOB_STORAGE_PATH));
const r = resolve(basePath);
if (!allowed.some((d) => r === d || r.startsWith(d + require('path').sep))) throw new Error('path outside allow-list: ' + r);

const isWithinAllowed = (p: string, allowed: string[]): p is string => allowed.some((d) => p === d || p.startsWith(d + '/'));

try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /within allowed directories/.test(e.message)) { throw new Error('set BLOB_STORAGE_PATH or move data under ~/.flowise') } else throw e }

When it happens

Trigger: An absolute path points outside ~/.flowise (and outside BLOB_STORAGE_PATH when unset), e.g. '/var/lib/mydata', '/tmp/vectors', or a relative path that resolves outside the allow-list via a symlink.

Common situations: Wanting to store vectors on a separate volume; Docker volume mounts outside the default dir; production deployments needing a custom data dir.

Related errors

• Invalid SQLite path: path must be within allowed directories
• Invalid path: path traversal attempt detected
• Invalid path: path traversal detected in resolved path
• Invalid path: encoded path traversal attempt detected
• Invalid path: null bytes or control characters detected

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/347b38777ed59ab0. Report an issue: GitHub.