FlowiseAI/Flowise · error · Error

Invalid path: UNC paths are not allowed

Error message

Invalid path: UNC paths are not allowed

What it means

Thrown by validateVectorStorePath (packages/components/src/validator.ts:249) when the base path matches ^\\\\[^\\] — a UNC path such as '\\\\server\\share'. UNC paths can reach arbitrary network locations, so Flowise forbids them regardless of host OS.

Solutions

1. Mount the network share locally and reference it via an allowed absolute path (~/.flowise or BLOB_STORAGE_PATH).
2. Copy the data into ~/.flowise/<name> and use that relative name.
3. If a network location is truly required, expose it via BLOB_STORAGE_PATH and ensure the resolved path stays inside it.

Example fix

// before
basePath = '\\\\fileserver\\ai\\vectors'

// after
basePath = 'vectors'   // data copied/mounted under ~/.flowise/vectors

if (/^\\\\[^\\]/.test(String(basePath ?? ''))) throw new Error('UNC paths not supported; use a local mount');

const isNotUnc = (p: unknown): p is string => typeof p === 'string' && !/^\\\\[^\\]/.test(p);

try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /UNC paths/.test(e.message)) { throw new Error('mount the share locally and retry') } else throw e }

When it happens

Trigger: A vector store node is configured with a UNC path like '\\\\fileserver\\ai\\vectors' or '\\\\localhost\\c$\\data'.

Common situations: Windows shop mounting vector data on a network share; containers inheriting SMB-mounted configs; copy-pasting paths from a UNC-mapped drive.

Related errors

• Invalid SQLite path: UNC paths are not allowed
• Invalid path: Extended-length paths are not allowed
• Invalid path: Windows absolute paths are not allowed
• Invalid path: encoded path traversal attempt detected
• Invalid path: null bytes or control characters detected

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/fbadf5c1ccc9293b. Report an issue: GitHub.

Appendix: source

Thrown at packages/components/src/validator.ts:249

    }

    // Check for URL-encoded path traversal
    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c')) {
        throw new Error('Invalid path: encoded path traversal attempt detected')
    }

    // Check for null bytes and control characters
    if (/\0/.test(basePath) || /[\x00-\x1f]/.test(basePath)) {
        throw new Error('Invalid path: null bytes or control characters detected')
    }

    // Check for Windows-specific absolute paths and UNC paths (even on Unix systems)
    // This prevents cross-platform attack vectors
    if (/^[a-zA-Z]:\\/.test(basePath)) {
        throw new Error('Invalid path: Windows absolute paths are not allowed')
    }
    if (/^\\\\[^\\]/.test(basePath)) {
        throw new Error('Invalid path: UNC paths are not allowed')
    }
    if (/^\\\\\?\\/.test(basePath)) {
        throw new Error('Invalid path: Extended-length paths are not allowed')
    }

    // Resolve to absolute path
    // If path is relative, resolve it relative to the .flowise directory (safe default)
    // If path is already absolute, keep it as-is
    let resolvedPath: string
    if (path.isAbsolute(basePath)) {
        resolvedPath = path.resolve(basePath)
    } else {
        // Relative paths are resolved within the .flowise directory for safety
        resolvedPath = path.resolve(path.join(getUserHome(), '.flowise', basePath))
    }

    // Verify the resolved path doesn't contain '..' after resolution
    if (resolvedPath.includes('..')) {

View on GitHub (pinned to abe4a8601a)