FlowiseAI/Flowise · warning · Error

Invalid path: path traversal detected in resolved path

Error message

Invalid path: path traversal detected in resolved path

What it means

Thrown by validateVectorStorePath (packages/components/src/validator.ts:268) when, after path.resolve(), the resulting absolute path still contains a '..' segment. path.resolve() normally collapses '..', so reaching this branch means an unusual input shape (e.g. a path composed such that resolve leaves a trailing/edge-case '..') slipped past the earlier substring check.

Source

Thrown at packages/components/src/validator.ts:268

    }
    if (/^\\\\\?\\/.test(basePath)) {
        throw new Error('Invalid path: Extended-length paths are not allowed')
    }

    // Resolve to absolute path
    // If path is relative, resolve it relative to the .flowise directory (safe default)
    // If path is already absolute, keep it as-is
    let resolvedPath: string
    if (path.isAbsolute(basePath)) {
        resolvedPath = path.resolve(basePath)
    } else {
        // Relative paths are resolved within the .flowise directory for safety
        resolvedPath = path.resolve(path.join(getUserHome(), '.flowise', basePath))
    }

    // Verify the resolved path doesn't contain '..' after resolution
    if (resolvedPath.includes('..')) {
        throw new Error('Invalid path: path traversal detected in resolved path')
    }

    // Check if resolved path is within allowed directories
    const allowedDirs = getAllowedVectorStoreBaseDirs()
    const isWithinAllowedDir = allowedDirs.some((allowedDir) => {
        const normalizedResolved = normalizePlatformPath(resolvedPath)
        const normalizedAllowed = normalizePlatformPath(allowedDir)
        return normalizedResolved === normalizedAllowed || normalizedResolved.startsWith(normalizedAllowed + path.sep)
    })

    if (!isWithinAllowedDir) {
        throw new Error(
            `Invalid path: path must be within allowed directories (${allowedDirs.join(', ')}). ` + `Attempted path: ${resolvedPath}`
        )
    }

    return resolvedPath
}

View on GitHub (pinned to abe4a8601a)

Solutions

1. Run path.normalize() on the candidate path yourself before passing it in.
2. Rebuild the path from trusted segments instead of string concatenation.
3. Use a relative name under ~/.flowise to avoid the absolute-path code branch.

Example fix

// before
nodeParams.basePath = someAbsPath   // resolves with a residual '..'

// after
const { path } = require('path')
nodeParams.basePath = path.normalize(someAbsPath)

const { normalize } = require('path');
const candidate = normalize(String(basePath ?? ''));
if (candidate.includes('..')) throw new Error('path still contains .. after normalize; rebuild it');

const isNormalized = (p: unknown): p is string => typeof p === 'string' && !normalize(p).includes('..');

try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /resolved path/.test(e.message)) { basePath = normalize(basePath) } else throw e }

When it happens

Trigger: An absolute path is supplied where path.resolve does not fully normalize '..' — extremely rare; typically indicates a malformed absolute path or a path ending in '..' after a non-normalizable prefix.

Common situations: Hand-crafted or programmatically concatenated absolute paths; platform-specific path quirks; effectively an internal-safety net rather than a routine config error.

Related errors

• Invalid path: path traversal attempt detected
• Invalid path: path must be within allowed directories (${all
• Invalid SQLite path: path traversal detected in resolved pat
• Invalid path: encoded path traversal attempt detected
• Invalid path: null bytes or control characters detected

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/303c4e49b8462a4e. Report an issue: GitHub.