FlowiseAI/Flowise · error · Error

Invalid path: UNC paths are not allowed

Error message

Invalid path: UNC paths are not allowed

What it means

Thrown by validateVectorStorePath (packages/components/src/validator.ts:249) when the base path matches ^\\\\[^\\] — a UNC path such as '\\\\server\\share'. UNC paths can reach arbitrary network locations, so Flowise forbids them regardless of host OS.

Source

Thrown at packages/components/src/validator.ts:249

    }

    // Check for URL-encoded path traversal
    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c')) {
        throw new Error('Invalid path: encoded path traversal attempt detected')
    }

    // Check for null bytes and control characters
    if (/\0/.test(basePath) || /[\x00-\x1f]/.test(basePath)) {
        throw new Error('Invalid path: null bytes or control characters detected')
    }

    // Check for Windows-specific absolute paths and UNC paths (even on Unix systems)
    // This prevents cross-platform attack vectors
    if (/^[a-zA-Z]:\\/.test(basePath)) {
        throw new Error('Invalid path: Windows absolute paths are not allowed')
    }
    if (/^\\\\[^\\]/.test(basePath)) {
        throw new Error('Invalid path: UNC paths are not allowed')
    }
    if (/^\\\\\?\\/.test(basePath)) {
        throw new Error('Invalid path: Extended-length paths are not allowed')
    }

    // Resolve to absolute path
    // If path is relative, resolve it relative to the .flowise directory (safe default)
    // If path is already absolute, keep it as-is
    let resolvedPath: string
    if (path.isAbsolute(basePath)) {
        resolvedPath = path.resolve(basePath)
    } else {
        // Relative paths are resolved within the .flowise directory for safety
        resolvedPath = path.resolve(path.join(getUserHome(), '.flowise', basePath))
    }

    // Verify the resolved path doesn't contain '..' after resolution
    if (resolvedPath.includes('..')) {

View on GitHub (pinned to abe4a8601a)

Solutions

1. Mount the network share locally and reference it via an allowed absolute path (~/.flowise or BLOB_STORAGE_PATH).
2. Copy the data into ~/.flowise/<name> and use that relative name.
3. If a network location is truly required, expose it via BLOB_STORAGE_PATH and ensure the resolved path stays inside it.

Example fix

// before
basePath = '\\\\fileserver\\ai\\vectors'

// after
basePath = 'vectors'   // data copied/mounted under ~/.flowise/vectors

if (/^\\\\[^\\]/.test(String(basePath ?? ''))) throw new Error('UNC paths not supported; use a local mount');

const isNotUnc = (p: unknown): p is string => typeof p === 'string' && !/^\\\\[^\\]/.test(p);

try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /UNC paths/.test(e.message)) { throw new Error('mount the share locally and retry') } else throw e }

When it happens

Trigger: A vector store node is configured with a UNC path like '\\\\fileserver\\ai\\vectors' or '\\\\localhost\\c$\\data'.

Common situations: Windows shop mounting vector data on a network share; containers inheriting SMB-mounted configs; copy-pasting paths from a UNC-mapped drive.

Related errors

• Invalid SQLite path: UNC paths are not allowed
• Invalid path: Windows absolute paths are not allowed
• Invalid path: Extended-length paths are not allowed
• Invalid path: path traversal attempt detected
• Invalid path: encoded path traversal attempt detected

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/fbadf5c1ccc9293b. Report an issue: GitHub.